codependix-export

SUSPICIOUS. The skill’s behavior is mostly coherent with a local dependency-graph/export tool and shows no credential harvesting or exfiltration, but install trust is incomplete because the exact `codependix` package and publisher were not verified while the skill encourages execution via `npx`. Risk is driven by unverifiable package provenance rather than malicious instructions in the skill itself.