ai-scientist

SUSPICIOUS. The skill's stated purpose is plausible, but its install path is not internally consistent with the referenced SakanaAI project. It directs users to install an unpinned third-party PyPI package with unverified same-org provenance, then provide API keys to code outside the official documented distribution path. No direct exfiltration or malicious behavior is shown in the skill text itself, but the publisher/install mismatch and credential forwarding to the installed package make this a high supply-chain risk.