iot-anomalies

SUSPICIOUS: the stated purpose is coherent, but the skill relies on unpinned runtime execution of a third-party npm package (`@latest`) from a project ecosystem that is adjacent to, not clearly the same org as, the Cognitum device vendor. No direct credential theft or overt exfiltration is shown, so this looks more like medium supply-chain risk than malware.