check-collaborators

SUSPICIOUS. The skill’s purpose and most capabilities are coherent and read-only, but the Gemini install instruction is materially inconsistent with the official publisher/package and creates a supply-chain trust problem. No clear credential theft or malicious data routing is present, so this is not malware, but the package-name mismatch makes the skill unsafe to treat as fully benign.