r06-alirezarezvani-claude-code-tresor-seo

SUSPICIOUS. The stated SEO purpose is plausible and the flagged network/install patterns are mostly documentation examples, but the distribution provenance is not internally consistent: the skill is branded as ara.so/alirezarezvani-derived while installation points to an unrelated GitHub owner and an unverifiable npm package name. No direct credential theft or covert exfiltration is shown, but install trust is weak enough to classify this as suspicious rather than benign.