giraffe-guard

SUSPICIOUS. The stated purpose is coherent, and the install path uses the official ClawHub CLI over npm, but trust is diluted by `npx @latest`, a third-party user publisher, and ZIP delivery from backend hosting with unclear artifact verification. No direct evidence of credential theft or malicious behavior is present in the provided skill content, so this is not malware, but it carries medium supply-chain risk.