odw

SUSPICIOUS. The skill’s capabilities fit its stated workflow-orchestration purpose, and the referenced install path appears same-project and docs-consistent rather than deceptive. However, it depends on a separately installed GitHub-distributed daemon plus `npm install`/setup, with local provider keys consumed by that daemon and no surfaced checksum/signature evidence, creating meaningful but not clearly malicious supply-chain and execution risk.