rekor

SUSPICIOUS. The core Rekor CLI install, domains, and credential flows are largely coherent and consistent with the stated purpose, so this is not clearly malicious. However, the skill is very broad and high-impact, and its instruction to install another skill from an unverified third-party GitHub owner introduces a significant transitive trust risk that is not necessary to operate Rekor itself.