tech-advisor

SUSPICIOUS: the skill’s purpose is coherent with web research for tech recommendations, but it expands trust to external runtime-installed packages and a third-party fetch proxy. Risk comes from supply-chain hygiene and untrusted-content processing rather than clear malicious intent; no credential harvesting, secret-file access, or disproportionate permissions are present in the instructions shown.