otterdrive

SUSPICIOUS: The skill’s artifact-management behavior is coherent with its stated purpose, and there is no clear exfiltration or malware logic. However, trust is weakened by unpinned npm installation, credential forwarding to the installed CLI, and inconsistent publisher/repository provenance in the provided evidence, so medium risk is warranted.