seoul-bike

SUSPICIOUS: the stated purpose is benign, but the skill is mostly a stub that offloads its real behavior to a remotely fetched npm CLI and mutable GitHub-hosted instructions. Same-org sourcing suggests this is not overtly malicious, yet the hidden-at-review-time instruction path and transitive update/install behavior are disproportionate for a simple bike-availability lookup skill.