soia-pkm-transform

SUSPICIOUS. The skill’s purpose and most capabilities are coherent for a document transformation router, and the install path appears official for the skills ecosystem. The main risks are transitive skill installation, unpinned `npx` execution, wildcard agent permissions, and moderate exposure from processing untrusted external content while having write/publish capabilities. No confirmed malware or credential-exfiltration behavior is evident from the supplied text.