lifecyclemodel-hybrid-search

SUSPICIOUS: the skill's purpose and requested API credentials are broadly aligned, and the documented data flow to a Supabase endpoint is coherent. However, it executes a remotely fetched npm package at runtime using a mutable @latest tag and forwards API credentials to that package, while the exact public provenance of @tiangong-lca/cli was not fully established from the evidence. This looks more like a supply-chain and credential-forwarding trust issue than confirmed malware.