tech-research

SUSPICIOUS: the skill’s core purpose is coherent, but its footprint is broader than a typical research skill because it combines untrusted-content ingestion, browser automation, local shell/config modification, and transitive browser-skill loading. I found no confirmed malware or credential theft, but the prompt-injection and execution-trust risks are substantial enough to classify it as medium-risk rather than benign.