jev-mailbox

SUSPICIOUS. The skill’s stated purpose, capabilities, and declared data flow are internally coherent for mailbox sorting, and the flagged `curl|sh` string is documentation about unsafe email content rather than an execution step. However, the workflow requires a `jev` CLI plus API key, and the provided evidence does not verify official CLI provenance or a trustworthy distribution path; because that binary receives credentials and processes mailbox data, the skill carries high supply-chain and privacy risk despite otherwise proportional behavior.