kimi-sync

SUSPICIOUS: the skill is largely aligned with its stated purpose and uses official Kimi web/app data, but it has meaningful security risk because it automates a logged-in browser, fetches remote ZIPs that overwrite local files, and may commit changes. No clear credential harvesting or off-purpose exfiltration is evident; the main concern is trusted remote-content ingestion with filesystem and git side effects.