k2f-resume

SUSPICIOUS. The visible skill content is mostly benign resume-authoring guidance and does not request credentials or show exfiltration, but it needlessly installs a separate third-party skill/toolchain to perform its core function. Because the install path is official and publisher-consistent, this is not strong evidence of malware; the main issue is transitive trust and moderate supply-chain risk.