weekly-plan

SUSPICIOUS. The stated purpose is coherent with the data it uses, and there is no explicit exfiltration or disproportionate credential request in the skill text. However, the core behavior depends on an opaque local helper script with unverifiable provenance, so the skill's effective trust boundary is hidden and should be treated as high supply-chain risk until the script source is reviewed.