enable-semantic-search

SUSPICIOUS. The skill's purpose and local data flow are mostly coherent, but the install trust is weakened by two factors: official-but-unpinned curl|bash for Bun and, more importantly, installing QMD from a GitHub repo spec instead of the maintainer's documented npm package. This looks more like risky setup hygiene than confirmed malware, with medium/high supply-chain risk but no clear credential theft or exfiltration behavior.