jsr

SUSPICIOUS: the skill's stated purpose is jsr.io access, but it routes authentication and all requests through third-party Unbrowse rather than official JSR APIs. The install path is not a malware-style downloader, yet the credential forwarding and intermediary data flow are disproportionate for a simple JSR search skill and the description understates that dependency.