labarchive-integration

SUSPICIOUS. The skill’s purpose and official API data flows are mostly coherent, but its installation guidance relies on a non-official personal GitHub wrapper that would likely receive LabArchives credentials. That unverifiable third-party dependency is disproportionate to a skill that could otherwise use direct requests to official endpoints, making this a supply-chain and credential-forwarding risk rather than confirmed malware.