sesion-mental-health-orchestration

SUSPICIOUS. The documented capabilities fit the stated clinic-orchestration purpose, and the scanner’s command-injection hits are benign documentation artifacts. The main issue is install trust: the skill publisher and referenced GitHub repo owner do not clearly match, yet the project would handle PHI, payment secrets, WhatsApp sessions, and AFIP certificate material. That mismatch plus the high-sensitivity data flows makes this higher-risk than a normal framework guide, though not confirmed malware.