openalex

SUSPICIOUS: the skill's purpose is coherent, but its install and credential flow are not. It asks users to install and trust a non-official third-party CLI for an OpenAlex integration and then store/forward an OpenAlex API key through that tool, which is disproportionate given official OpenAlex documentation points to a different CLI. No confirmed malicious payload or exfiltration is shown, but the supply-chain and credential-forwarding risks are high enough to avoid classifying it as benign.