connect

SUSPICIOUS. The skill's capabilities mostly fit its stated purpose: local version checks, device pairing, status checks, and Cursor plugin setup are coherent for connecting an agent to Altitude. The main concern is install and publisher trust: the npm package/related repo appear tied to a personal account rather than clearly verifiable same-org Altitude ownership, and official CLI documentation was not established from the evidence. Data flow appears proportionate and there is no sign of credential exfiltration beyond the intended Altitude CLI device flow, so this is not confirmed malicious; it is a medium-risk trust/provenance issue.