mo-shared

SUSPICIOUS. The skill’s stated purpose is coherent for a CLI helper, but its footprint includes a required external binary (`mocli`) whose publisher, install path, and release provenance could not be verified. Because the skill also forwards an API key to that unverifiable CLI, the risk is materially elevated even without explicit malicious behavior in the instructions.