tavily-hikari-cli

SUSPICIOUS: the skill is internally coherent for a managed Hikari deployment, but it routes Tavily activity and credentials through a non-official intermediary and requires an unverifiable wrapper CLI. That makes the main risk credential forwarding and full request visibility by third-party code/service, not confirmed malware.