bunjang-search

SUSPICIOUS: the skill’s stated purpose is plausible, but its actual behavior is largely hidden behind runtime-fetched instructions and a transitive external tool chain. Provenance appears partly same-org and not overtly malicious, yet the remote-instruction design and second-hop dependency make the skill less auditable and raise supply-chain risk beyond a normal static guide.