laohan-cheat

SUSPICIOUS: The skill’s core file-reading, scoring, prediction, and state-management behavior matches its stated purpose, so there is no clear malicious mismatch. Risk comes from broad Bash(*)/Skill permissions, execution of an unreviewed local bridge.sh outside the project, and optional forwarding of content data to an MCP backend whose provenance is not specified in the skill.