oracle

SUSPICIOUS. The skill is mostly coherent with its stated purpose and uses same-publisher distribution paths, so this is not confirmed malware. The main security concern is disproportionate credential handling: it explicitly instructs pulling a personal OpenAI API key from 1Password and forwarding it to a third-party CLI, while the tool also uploads local file bundles and can route data through browser/remote-host automation. That combination makes the skill medium risk despite otherwise legitimate workflow guidance.