labarchive-integration

SUSPICIOUS: The skill’s stated purpose and data flows are mostly coherent for a LabArchives API integration, and it targets official LabArchives endpoints rather than a proxy. The main risk is install trust: it forwards sensitive LabArchives credentials to a community GitHub wrapper that is not verifiably official or pinned, which creates a disproportionate supply-chain and credential-forwarding risk. The CLI token example also encourages insecure secret handling.