file-indexer

SUSPICIOUS: the core behavior matches the stated purpose, but the skill uploads local file metadata to an unspecified remote service with no endpoint, publisher, or auth details. The main risk is unverifiable data destination rather than confirmed malware or supply-chain abuse.