skill-map

SUSPICIOUS. The skill’s behavior is largely coherent with its stated purpose: it maps local skill files, avoids sensitive transcript/cache paths by default, and does not route data to third-party endpoints or request credentials. The main issue is install/execution trust: it requires an external ai-skillet binary with unclear verifiable provenance, so the skill inherits high supply-chain risk despite otherwise benign local-only data flow.