remindb-setup

SUSPICIOUS: the skill's overall purpose and capabilities mostly align with a setup wizard, and the command-injection/autonomy findings are weak. However, it instructs remote installation of a CLI plus transitive plugin/skill installation without enough verifiable provenance in the skill itself, creating medium supply-chain risk.

No direct malware or data-theft behavior is present in the supplied documentation. The primary security concern is the installation guidance, which uses unpinned remote script execution and a self-update path that may execute changed remote content. Review and verify the referenced installer scripts and release artifacts before use; prefer signed or checksum-verified binaries and inspect scripts locally. The configuration descriptions alone do not demonstrate malicious behavior.