blog

SUSPICIOUS: the blog skill itself is mostly a benign local editing pipeline, but it delegates essential behavior to multiple unpinned /skill dependencies, including ambiguous or unverified publishers. The main risk is transitive trust and mutable supply chain exposure, not direct malware or exfiltration in this snippet.