spine-matrix

SUSPICIOUS. The stated Matrix read/write purpose is coherent and the OAuth/device-flow guidance matches normal Matrix auth, with no clear third-party exfiltration path in the text. However, the skill's main functionality depends on a local `matrix` CLI/script whose provenance is not verifiable here, and that binary handles access/refresh tokens and room data; by policy this creates high supply-chain risk even though the visible instructions are otherwise proportionate.