bear-notes

SUSPICIOUS: the skill's purpose is coherent, and its token usage aligns with Bear's documented API, but it relies on an unofficial third-party CLI from a personal GitHub repo and forwards Bear credentials to that tool. This is a proportionate note-management skill with notable supply-chain and credential-trust concerns, not confirmed malware.