web-search

SUSPICIOUS. The skill's capabilities broadly match its stated web-search purpose, and there is no clear credential harvesting or malicious data exfiltration. However, it installs third-party tooling and unspecified local npm dependencies, both without version pinning, and then uses local scripts to fetch/process untrusted web content. This is a coherent but moderately risky skill rather than confirmed malware.