papermark

SUSPICIOUS: the skill’s capabilities largely match its stated Papermark dataroom-inspection purpose, and its credential scope is proportionate. However, it instructs installation and use of an external CLI that receives session tokens, while the provided evidence does not clearly verify the CLI package/source as an official Papermark-published tool. This creates a meaningful supply-chain and credential-forwarding risk even without signs of overtly malicious behavior.