kg-pack

SUSPICIOUS. The stated purpose mostly matches the capabilities, but the skill’s footprint is too trust-heavy: it clones and runs a personal GitHub repo, requires an API key, ingests untrusted web content, and installs additional skills whose content is not reviewed here. The main issue is high supply-chain and transitive-trust risk rather than confirmed malware.