daangn-realty-search

SUSPICIOUS. The stated purpose fits a real-estate search/assistant workflow, but the skill is mainly a loader that delegates its actual instructions to a remotely fetched npm CLI and same-repo content. I found no clear credential harvesting, exfiltration, or hidden malicious behavior, yet the transitive trust in mutable runtime-fetched instructions and coarse version pinning makes the skill medium risk rather than benign.