algal-fetch

SUSPICIOUS. The stated purpose is coherent for a web-fetch skill, and no credential collection or off-purpose data flow is evident. However, the skill delegates all behavior to an unpinned `bunx`-executed package (`algal-skills`) that could not be verified as an official, same-org, documented release. Under the mandatory unverifiable dependency rule, this makes the skill high risk even without clear malicious intent.