discovery-skills

SUSPICIOUS: the skill’s stated purpose is plausible and there is no direct exfiltration in the guide, but the install trust story is inconsistent. It asks users to install an executable Zotero add-on from an unverified publisher path, while the identifiable popular upstream project belongs to a different account and uses a different workflow with additional secrets. This is primarily a supply-chain and provenance problem rather than confirmed malware.