graincrawl

SUSPICIOUS. The skill’s core capabilities are proportionate to maintaining a local archive CLI, and its data handling is mostly privacy-preserving. The main issue is install/release trust: the Homebrew tap in the skill does not match the publicly documented upstream release channel, creating a moderate supply-chain concern even though no credential theft, covert exfiltration, or malicious execution pattern is evident.