jev-search

SUSPICIOUS: The skill’s stated behavior is coherent and the only direct finding is a bounded prompt-injection surface with mitigations. However, the required Jev executable/tool has weak provenance based on available evidence: a personal-repo, mutable-branch install path and a command-name mismatch make the dependency insufficiently verifiable. Data flow to apparently official Jev/OpenRouter-style endpoints is proportionate to purpose, but the external CLI trust gap keeps overall risk elevated.