feedgrab-setup

SUSPICIOUS. The skill’s purpose is coherent for a content-grabber setup guide, but the actual install instructions are not internally consistent with the available upstream evidence: it tells users to install an unpinned PyPI package that could not be verified as the project’s official distribution path. The skill also forwards tokens and browser-derived session cookies into a third-party CLI and recommends broad `[all]` extras, which is high-risk when package provenance is uncertain. No confirmed exfiltration or malware behavior is shown in the skill text itself, but the supply-chain and credential-forwarding exposure are disproportionate enough to classify it as suspicious rather than benign.