openevidence

SUSPICIOUS: the skill's behavior mostly matches its stated purpose, but it asks the agent to install and trust a third-party GitHub-hosted MCP/extension stack and route account activity through that code. No clear malicious or deceptive exfiltration behavior appears in this skill text, yet the external install and browser-extension trust make it a medium-risk orchestration skill rather than benign low-risk documentation.

The configuration contains a significant supply-chain risk because it executes an unpinned remote shell script during container creation through curl | bash. This is an arbitrary-code-execution mechanism and should be replaced with a reviewed, locally stored, commit-pinned, or checksum-verified script. The supplied fragment alone does not establish that the remote script is malicious.