cli-anything-cloudcompare

SUSPICIOUS. The skill’s capabilities and local file access fit a CloudCompare automation tool, and there is no credential access, exfiltration, or hidden execution. The main issue is install trust: the documented PyPI package path is not well verified against public evidence and may not match the publisher’s apparent GitHub-based distribution, creating a moderate supply-chain concern rather than clear malicious intent.