graph-query

SUSPICIOUS. The skill’s purpose is coherent with querying a local code graph, and there is no sign of credential harvesting or unrelated data exfiltration. However, the documented installation flow is inconsistent with the surfaced repo contents and official docs, and it relies on executing mutable shell scripts from GitHub, creating medium supply-chain risk.