methodology-skills

SUSPICIOUS. Most content is benign methodology documentation, but the bundle includes one more agentic skill that reads local workspace state, downloads remote paper sources, clones repos, and directs use of other skills. Install/data flows are mostly research-aligned, yet provenance is mixed and the autonomy/transitive-trust patterns make the overall skill set higher risk than a passive methodology guide.

SUSPICIOUS. The skill's core behavior is broadly consistent with literature-based idea generation, so the backtick findings are benign documentation artifacts, not command injection. Risk comes from unverified cloning of arbitrary repos, direct extraction of remote archives, and transitive dependence on another skill without provenance.