algal-research

SUSPICIOUS: the purpose is coherent for a research skill, but the actual footprint depends almost entirely on an unpinned external npm CLI executed through `bunx`. Because the `algal-skills` package provenance was not verified, the install/execution trust is disproportionate enough to treat this as high supply-chain risk even without evidence of explicit credential theft or exfiltration.