codedb-mcp-fast-code-intelligence

SUSPICIOUS. The skill’s capabilities largely fit its stated code-intelligence purpose and data flow is mostly local, but install trust is only partially established: ara.so publishes the skill while the binary source is a separate GitHub owner, with no verified same-org release/signing trail, plus optional third-party model downloads. No direct credential harvesting, covert exfiltration, or malicious pre-execution behavior is evident.