officecli-word-form

SUSPICIOUS. The skill’s capabilities are strongly aligned with its stated purpose of generating fillable Word forms, and it does not request disproportionate credentials or route user data to odd endpoints. The main concern is install trust: it tells the agent to download and execute a remote installer script and trust an external CLI binary, with same-project evidence but no strong artifact-verification signals. This is a medium supply-chain risk, not confirmed malware.