odw

SUSPICIOUS: the skill’s purpose and capabilities mostly align, but it relies on externally sourced, unbundled executable code from a personal GitHub repo, installs npm dependencies from cloned source, and may use provider keys from `~/.odw/config.json` through a persistent local daemon. This is not confirmed malware, but the supply-chain and credential-forwarding footprint is high enough to treat as a high-risk skill.