assist-sessions

SUSPICIOUS. The skill’s purpose and capabilities mostly align, but trust rests on an unverifiable bundled CLI plus an overrideable server endpoint that can route sensitive session transcripts elsewhere. Lack of external provenance for the backend/package path and credential forwarding of ANTHROPIC_API_KEY to local script code make this medium risk even without clear malware indicators.