nlm-cli-skill

SUSPICIOUS. The skill is coherent with its purpose and shows no hidden exfiltration or malicious install chain, but it centers on an unofficial, archived third-party CLI that authenticates by extracting Chrome cookies and can perform impactful remote actions. That makes the trust and credential model materially riskier than a normal official API integration.