mock-ollama

SUSPICIOUS. The skill’s proxy/monitoring behavior is consistent with its stated purpose, but it requires routing all LLM traffic and upstream API keys through a globally installed third-party CLI, with unpinned npm install and only partial publisher verification. This is not confirmed malware, but it is a medium-high security risk due to credential forwarding and full visibility into prompt/response data.