soia-pkm-baidupan

SUSPICIOUS. The stated purpose broadly matches a Baidu Netdisk integration, but the trust model is elevated: it requires transitive skill installation, relies on upstream download-execute scripts, and optionally sends credentials to a community CLI from a personal GitHub project. The official path may be legitimate, but without strong verification the install and dependency chain are higher risk than a narrowly scoped storage skill should need.