korean-middle-korean

SUSPICIOUS: the stated purpose is benign and the publisher/package relationship appears legitimate, but the skill is mostly a stub that delegates behavior to remotely fetched same-org instructions executed through `npx`. That creates medium supply-chain and control-plane risk, especially with mutable `@0` versioning and transitive update paths, though there is no evidence here of credential theft, exfiltration, or clearly malicious behavior.