prose

SUSPICIOUS. The core VM/execution behavior fits the skill's stated purpose, and the install steps for PostgreSQL tooling are mostly standard and verifiable. The main concerns are proportionality and data flow: the skill can fetch and execute remote `.prose` programs from arbitrary URLs or an insufficiently verified registry host, and postgres mode intentionally passes database credentials into subagent contexts and logs. This is not confirmed malware, but it meaningfully expands execution and credential exposure beyond a low-risk documentation skill.