k2f-event-program

SUSPICIOUS: the core content-authoring purpose is benign and well aligned, but the skill expands its footprint by requiring installation of another third-party skill. Install paths are partly verifiable and docs-consistent, yet provenance is weakened by documentation inconsistency and transitive trust remains the main security concern. No clear credential harvesting, exfiltration, or stealth behavior is present.