mofa-travel-safety

SUSPICIOUS: the stated purpose is benign and read-only, but the skill’s actual behavior is largely delegated to a remotely fetched same-publisher CLI package and linked GitHub instructions. This is more a trust and reviewability problem than confirmed malicious behavior: medium supply-chain risk, no clear credential theft or exfiltration in the provided stub.