travel-companion

SUSPICIOUS. The skill’s purpose and data flow are mostly coherent for travel planning, but it relies on executing a remotely fetched npm CLI with unpinned @latest guidance and weak publicly verifiable package provenance. The main concern is install/execution trust rather than clear malicious behavior or disproportionate data access.