task-estimator

SUSPICIOUS: the skill’s goal is legitimate and the `taskmarket` CLI appears same-ecosystem and npm-distributed, but the skill executes commands at load time before user approval. That design is higher risk than necessary for cost estimation, and the unverified `fetch-model-pricing` helper adds unresolved supply-chain and data-flow uncertainty. No confirmed credential theft or overt exfiltration is shown.