promql-cli

SUSPICIOUS. The skill’s purpose and data flows are mostly coherent for Prometheus querying, and it avoids obvious credential harvesting. However, it requires installing and trusting a third-party archived CLI from a different publisher, using an install path that appears inconsistent with upstream documentation; this creates moderate supply-chain and credential-forwarding risk rather than clear malware behavior.