jevgraph

The skill's purpose and capabilities mostly align: graph analysis, local snapshot handling, and read-only Notion retrieval are coherent. The main issue is install and credential trust: it directs the agent to execute an unpinned GitHub-hosted CLI outside the normal npm registry path, then pass Notion and semantic API credentials to that CLI. That makes this skill suspicious with high security risk from supply-chain and credential-forwarding exposure, not confirmed malware.