scholar-search

SUSPICIOUS: the skill’s purpose is coherent, but it relies entirely on unpinned third-party PyPI CLIs and forwards an optional API key to a non-official wrapper. This looks more like supply-chain and credential-forwarding exposure than malware; no clear exfiltration, stealth, or unrelated capabilities were found.