flomo-insight

SUSPICIOUS: the stated purpose is coherent, and requested data access is proportionate to note analysis, but the skill's required flomo-local-api dependency is not verifiably official or clearly documented. Because the core data-access layer is opaque and appears to diverge from flomo's documented same-org MCP/OAuth path, this is a high install-trust risk even without direct evidence of exfiltration.