use-spark

SUSPICIOUS. The skill is broadly aligned with its stated Spark email/calendar purpose and uses the vendor's local Spark CLI rather than routing data to an unrelated third-party endpoint. However, it grants high-impact mailbox and scheduling actions, includes a self-updating skill rewrite path, and installation/update trust is only moderately verifiable through same-org GitHub and Spark docs rather than stronger signed release artifacts. This is not confirmed malware, but it is a medium-risk agent skill due to real-world action capability and transitive trust.