aris-infra

SUSPICIOUS. The skill’s core behavior mostly matches its stated infrastructure purpose, and the Codex npm install is consistent with official docs. Risk remains medium because the setup bootstraps multiple MCP bridge servers from a personal repo, forwards sensitive API keys through local bridge code, and relies on an unseen shell setup script that could broaden its footprint.