clipboard-sync-cross-device

SUSPICIOUS: the skill’s behavior matches its clipboard-sync purpose and data flows go to expected services, but install trust is only moderate because the publisher directs users to a separate third-party GitHub repo and unpinned PyPI dependencies. No clear credential-harvesting or malicious exfiltration is shown, yet the skill handles very sensitive clipboard data and local auth tokens, so the overall risk is medium.