thesis-workflow-agent

SUSPICIOUS. The skill’s thesis-writing purpose broadly matches its file access and document-processing behavior, but its footprint expands through required sub-skills, local config credential injection, and optional external services. The biggest concerns are transitive trust in bundled/global sub-skills, forwarding API keys to unseen MCP components, and routing thesis materials to third-party services such as Paperyy/FreeConvert and possibly Suxi’s gateway-style API. Not overtly malicious, but it carries medium risk and should be reviewed together with the bundled sub-skills and MCP code before use on sensitive thesis material.