okf-open-knowledge-format

SUSPICIOUS. The core skill is mostly coherent and locally scoped for OKF authoring/validation, but its optional `kcmd` install instruction is inconsistent with official Google-documented distribution and may point users to an unrelated npm package. No direct malware or credential theft behavior is present, but the supply-chain trust issue makes the skill medium risk overall.