exa-researcher

SUSPICIOUS: the visible snippet is mainly a third-party skill installer, not the research logic itself. The main risk is transitive trust and unpinned `npx` execution from an official-but-community registry; there is no direct evidence of malware or credential theft in the provided content, but the actual installed skill remains opaque.