rclone

SUSPICIOUS: the skill is internally coherent and uses a legitimate official tool, but it grants an AI agent high-impact offensive file-transfer capability and forwards stored cloud credentials through that CLI. Risk comes from real-world transfer actions and weak technical enforcement of approval boundaries, not from malware-like deception.