mathodology-whole-project

SUSPICIOUS: the skill’s purpose broadly matches backup/install/orchestration, but its footprint includes mutable remote script execution, unpinned npx latest execution, and transitive skill installation. Data flows stay with GitHub/npm and local files rather than obvious exfiltration endpoints, so this is not confirmed malware, but the install trust model is riskier than necessary.