harvard-artifacts-data-pipeline

SUSPICIOUS. The skill’s stated purpose, credentials, and data flows are mostly consistent with a Harvard API ETL dashboard, and it routes data directly to official Harvard and user-specified database endpoints. The main concern is install trust: the skill published by ara.so points users to clone and run code from an unrelated personal GitHub repository with no same-org verification, plus unpinned Python dependencies. This makes the skill medium risk but not clearly malicious.