paper-2-web

SUSPICIOUS. The skill’s stated purpose is coherent, but its actual footprint depends on cloning and running a third-party GitHub pipeline while the skill is published by K-Dense Inc., and it also encourages installing/using another skill. That mismatch in publisher vs. execution source, combined with forwarding API keys to external code via Bash-enabled workflows, creates medium risk even without clear malicious exfiltration.