seoul-subway-arrival

SUSPICIOUS. The stated purpose is benign, but the published skill is only a wrapper that shifts trust to remotely fetched instructions from an npm CLI and GitHub content. Same-org provenance makes this more consistent than a random third-party payload, so it is not malicious, but the runtime delegation and mutable package version make the footprint less trustworthy than a self-contained subway lookup skill.