openevidence

SUSPICIOUS: the skill is largely coherent and uses official service endpoints, but it depends on raw browser session cookies and an unofficial client pattern rather than a documented auth flow. Main risk is credential exposure/forwarding from cookies.json, especially if OE_BASE_URL is overridden; supply-chain risk is low because there is no download-execute step.