dep-security

SUSPICIOUS. The core purpose is coherent with dependency vulnerability checking, and the queried endpoints are legitimate public advisory sources. However, the skill depends on a third-party vendor CLI/service and the install instruction is inconsistent with the vendor's official package name, while data about the user's dependencies is sent through TinyFish despite the skill framing this as simple live database checks. This is better classified as medium risk supply-chain/trust inconsistency than malware.