denario

SUSPICIOUS: the core capabilities mostly fit a research-automation skill, and installs use normal PyPI tooling, but provenance is not fully coherent because the skill is published as K-Dense Inc. while the package/source trail points to AstroPilot-AI. No direct credential theft or overtly malicious data exfiltration is shown, yet the combination of third-party package trust, API-key forwarding, and broad multiagent automation makes this a medium-risk skill that warrants caution.