mitre-attack-lookup

SUSPICIOUS. The skill’s purpose is coherent and its data flow is mostly local, but it requires cloning and executing Python code from a personal GitHub repository without verifiable release controls or registry distribution. That creates a disproportionate supply-chain risk for a lookup skill even though there is no evidence of credential theft or overtly malicious behavior.