openindex-wiki

SUSPICIOUS: the skill’s capabilities mostly match its stated wiki purpose and its documented data flows stay on the OpenIndex domain, but it still carries medium risk from executing an only partially verified npx package, forwarding tokens through that CLI, and enabling autonomous public posting/deletion and rent-related actions. No clear evidence of credential theft, covert exfiltration, or malicious mismatch was found.