literature-search

SUSPICIOUS: the core purpose is coherent and endpoints appear purpose-aligned, but the skill unnecessarily reads a raw API key from a local markdown file and forwards it to unverifiable local wrapper scripts, including scripts outside this skill’s directory. No clear malware or exfiltration endpoint is shown, but credential handling and cross-skill script trust make the footprint riskier than a typical literature-search helper.