setup-liana-remote-tool

SUSPICIOUS. The skill’s capabilities mostly fit its stated purpose, and there is no clear credential theft or malicious exfiltration. However, install trust is weakened by a direct-download relay wheel from a non-registry domain plus remote-fetched requirements and a free-hosted backend endpoint; these are proportionate to the purpose but raise medium-high supply-chain risk.