query

SUSPICIOUS: the skill's purpose and local file access are proportionate, and there is no sign of credential harvesting or malicious data exfiltration. However, it relies on a same-org but proprietary CDN-delivered binary, making the installation trust footprint materially riskier than the simple document-query purpose suggests.