kasia

SUSPICIOUS. The stated purpose is coherent, but the provided skill text is only a thin wrapper around transitive installation through `npx clawhub@latest install kasia`. The main concern is install trust and hidden downstream behavior of the fetched CLI and installed skill; there is no evidence here of credential theft or malicious data routing, but the footprint is under-specified and relies on mutable remote code.