kakao-bar-nearby

SUSPICIOUS. The stated purpose is coherent with a location-search skill, and the references point to same-org npm/GitHub sources rather than obvious attacker infrastructure. However, the skill is only a stub: its real behavior is fetched and executed at runtime through an external CLI, making the effective instructions mutable and not fully auditable from this artifact alone.