setup-immune-compass-remote-tool

SUSPICIOUS: the skill’s purpose largely matches its actions, and several safeguards are present, but it installs a non-PyPI relay package from a custom domain and then entrusts that code with platform authentication and forwarding. That unverifiable third-party install path materially raises supply-chain and credential-forwarding risk even though the rest of the workflow is coherent.