soia-pkm-organize-article-moc

SUSPICIOUS. The core vault-organizing behavior is coherent and mostly local, but the installation model expands trust to additional plugins/skills and the documented npx path uses wildcard permissions. This looks more like a legitimate but over-broad skill ecosystem dependency chain than confirmed malicious behavior.