granola

SUSPICIOUS. The stated purpose is plausible, but the skill's actual dependency footprint is not internally consistent with official Granola documentation: it relies on an unverified external CLI, likely from a personal repo, that handles OAuth credentials and adds another helper tool. Because an unverifiable CLI appears to receive credentials, risk is high even without confirmed malware.