civic-skill

No strong signs of intentional malware (no obfuscation, no dynamic execution, no stealth/persistence, no obvious secret harvesting). However, the module has high-impact security behaviors when fed attacker-controlled input: it can read arbitrary local files via query_path and transmit their contents to a remote server as the GraphQL query, and it can write arbitrary files via raw_output_path when save_raw is enabled. These are misuse/exposure risks that depend heavily on who controls the stdin payload and what filesystem permissions the process has.