flomo-analysis-studio

SUSPICIOUS: the skill's stated purpose matches its capabilities, and this wrapper does not itself show credential theft, exfiltration, or hidden execution. However, it relies on a separate unofficial third-party flomo-local-api skill installed through a transitive GitHub/skills.sh trust chain to access highly sensitive personal notes, so the main risk is dependency trust and inherited data-handling uncertainty rather than confirmed malicious behavior.