code-exec-skills

SUSPICIOUS. The overall skill is mostly a benign documentation bundle for notebook and reproducibility workflows, and most flagged patterns are expected examples. However, the Overleaf guide introduces a non-official third-party sync CLI for a branded service and implies secure credential handling without same-org provenance; combined with unpinned/source installs elsewhere, this creates a moderate trust and credential-forwarding concern disproportionate to an otherwise guide-oriented skill.