data-structure-protocol

SUSPICIOUS. The skill’s behavior mostly matches its stated code-structure mapping purpose, but it depends on an external unbundled CLI from a personal GitHub repo and the upstream project documents mutable remote-script installers. This is more a supply-chain and install-trust issue than clear malicious behavior; no credential harvesting or unrelated data exfiltration is evident from the skill text.