ecosystem-database

SUSPICIOUS: the visible skill is mostly a dispatcher that installs additional, unreviewed skills via an unseen local script. There is no direct evidence of malware or credential theft in the provided text, but the transitive installation pattern and unverifiable installer behavior create meaningful supply-chain risk.