khalas

SUSPICIOUS. The skill’s stated functionality is coherent and credential scope is minimal, but it depends on an unverified local `khalas` executable with no discoverable official provenance or documented install source. That makes the main risk supply-chain trust rather than confirmed malware.