coinbase

Suspicious due to explicit remote skill installation from a mutable raw GitHub URL, but otherwise the skill is a documentation/persona guide with no direct credential access, exfiltration, or exploit behavior. Main risk is transitive trust, not confirmed malicious intent.