google-office

SUSPICIOUS: the skill’s functional scope fits its purpose, but its trust chain is not internally consistent because it points to a CLI/publisher identity that does not cleanly match the verifiable official project evidence. No clear malicious exfiltration is shown, but relying on a mismatched third-party CLI to manage Google OAuth and data access creates meaningful supply-chain and credential-forwarding risk.