assembly-bill-vote-search

SUSPICIOUS: the declared civic lookup purpose is plausible, but the published skill is mostly a loader that tells the agent to execute an external npm CLI and follow remote, runtime-selected instructions. The proxy-based API routing and transitive trust chain are disproportionate to a simple read-only search skill, even without clear proof of outright malware.