li

SUSPICIOUS. The skill is largely coherent with a power-user knowledge-management role and mostly operates on local files plus official Zotero/Microsoft flows, but it has a broad operational footprint and includes a medium-risk transitive skill-install step via a third-party CLI during CURATE. No clear credential harvesting, exfiltration, obfuscation, or malicious mismatch is evident; the main concerns are supply-chain trust and the breadth of file/command permissions.