extract-tables

SUSPICIOUS. The core capability fits PDF table extraction, and no direct credential theft or explicit malicious endpoint is shown, but the skill has under-specified execution through local shell scripts, broad composition with internal agent services, and unclear document flow to classifier/teacher endpoints. This is a moderate security-risk skill rather than confirmed malware.