learn-craft

SUSPICIOUS. The skill’s capabilities mostly match its stated purpose, but it relies on unofficial LibGen/CDN downloads and then processes untrusted PDFs and web content with subagents that can write persistent files. There is no sign of overt credential theft or hidden malware behavior, but the external content trust model and prompt-injection exposure make this a medium-high security risk.