natural-language-postgres-presentation

SUSPICIOUS. The skill’s capabilities mostly fit its stated purpose, but install trust is weakened by cloning executable app code from a mutable GitHub repo with a publisher/repository provenance mismatch and no release verification. No clear malicious behavior or credential-harvesting endpoint is shown, so this is better classified as supply-chain and trust risk than confirmed malware.