gitnexus-explorer

SUSPICIOUS: the skill is largely purpose-aligned for codebase graphing and remote sharing, but it carries medium supply-chain and exposure risk because it builds third-party code from GitHub/npm and downloads an unpinned `cloudflared` binary, then can publish repo-derived data through a public tunnel. No clear credential harvesting, hidden exfiltration, or malicious mismatch is present.