ontoly-software-graph

SUSPICIOUS. The skill’s purpose is coherent, but it relies on an external `ontoly` CLI/MCP that is not verifiably tied to an official developer-tool publisher from the provided evidence. That mismatch makes the install/execution trust and potential data flow unclear, so the skill is not malicious on its face but carries high supply-chain risk until the vendor, install path, and network behavior are verified.