kakaotalk-mac

SUSPICIOUS: the stated purpose is narrow, but the shipped skill is mostly a remote instruction loader. Same-org npm/GitHub sourcing reduces maliciousness concerns, yet mutable runtime-fetched guidance, non-exact versioning, and transitive skill-update behavior make the trust model broader than the local-search purpose suggests.