nexus-vote

SUSPICIOUS rather than malicious. The skill's behavior is coherent with its stated purpose and its GitHub data flow is official and proportionate, but it depends on an unverifiable `probe` CLI that performs reads and a write on the user's behalf. That unverifiable binary requirement materially raises supply-chain and trust risk even though no clear credential theft or deceptive exfiltration is shown.