bishop

SUSPICIOUS. The skill’s capabilities mostly match its stated network-admin purpose and data flows stay on local UniFi/AT&T endpoints, so this is not confirmed malware. However, the skill is high-impact: it handles admin credentials, can automate device actions, and explicitly disables TLS verification, which is a meaningful security weakness. The unnamed Chrome MCP dependency also adds trust uncertainty. Overall this looks purpose-aligned but security-risky rather than malicious.