flowus-cli

SUSPICIOUS rather than malicious. The skill’s purpose aligns with its capabilities and its data flows point to FlowUs, but it relies on an externally installed, not-publicly-verifiable CLI distributed via raw CDN installer scripts. That creates high supply-chain risk, especially because the CLI handles FlowUs credentials and performs remote writes, even though the instructions themselves are cautious and not overtly deceptive.