harvard-art-museum-etl-analytics

SUSPICIOUS. The skill’s stated ETL/analytics behavior is coherent and its data flows mostly match the purpose, but the install provenance is inconsistent: a skill published under ara.so/data-skills points users to clone an unrelated personal GitHub repo, then install mutable dependencies and run it with API/database credentials. No direct exfiltration or malicious behavior is shown, so this is not confirmed malware, but the trust chain is weaker than expected for a benign skill.