harvard-art-museums-etl-pipeline

SUSPICIOUS. The ETL/database/dashboard capabilities match the stated purpose and data flows go to official Harvard and local DB endpoints, so there is no clear exfiltration or malicious logic. However, install trust is weakened because the skill published by ara.so tells users to clone and run code from an unrelated personal GitHub repository, plus unpinned dependencies. That mismatch makes the skill risky enough to flag as suspicious rather than benign.