harvard-artifacts-etl-streamlit-app

SUSPICIOUS. The skill’s capabilities and credential use fit its ETL/dashboard purpose, and data flows go directly to the official Harvard API and the user’s database. The main issue is install trust: the skill published by ara.so wraps an unrelated personal GitHub repository with ordinary but unpinned pip-based dependencies and a small run-instruction inconsistency. That is a meaningful supply-chain risk, but there is no sign of credential exfiltration, hidden execution, or malware.