codegraph-ast-grep

SUSPICIOUS. The skill is broadly aligned with its setup/update/doctor purpose and does not show exfiltration, credential harvesting, or covert behavior. The main risk is supply-chain ambiguity: it asks the agent to install 'CodeGraph' without naming a single verifiable publisher/channel, while evidence shows multiple unrelated CodeGraph products with different installers and secondary downloads. That makes the install path insufficiently precise for a trusted skill, though not malicious on its face.