soia-pkm-clip-drive

The stated purpose is coherent: importing local/cloud-synced documents into an Obsidian vault and organizing notes. The main risk is not the document-processing behavior itself but the installation model: a transitive `npx skills add` flow with wildcard `-a '*'` permissions grants far broader agent capability than necessary for this task. No clear credential harvesting or exfiltration is shown in the provided skill text, so this is better classified as suspicious/high-risk installation trust rather than malware.