agent-reach

SUSPICIOUS. The skill's capabilities largely match its stated research-routing purpose, but trust is weakened by an unpinned same-org GitHub install path, transitive reliance on third-party CLIs for login-backed platforms, and use of an intermediary fetch service. This looks more like a legitimate but high-trust workflow skill than confirmed malware; the main concerns are supply-chain exposure and broad ingestion of untrusted external content.