status-updates

SUSPICIOUS: the skill's messaging behavior is broadly consistent with its stated purpose, but trust and data-flow details are incomplete. Main risk is outbound transmission of session metadata through unspecified MCP connectors and an unspecified local hook script, not clear evidence of malware or credential theft.