vikunja

SUSPICIOUS: the core Vikunja-to-Joplin purpose is coherent and the Vikunja token requirement is proportionate, but the prerequisite installation of a separate Joplin skill from a personal GitHub repo creates a transitive trust and supply-chain concern. No direct credential theft or malicious exfiltration is evidenced here, so this is not confirmed malware.