article-bookmarker

This skill appears to implement a git-backed bookmark manager and will write/commit/push markdown files under whatever path you set in ARTICLE_BOOKMARK_DIR. Before installing or enabling it: - Use a dedicated directory for ARTICLE_BOOKMARK_DIR (do not point it at a directory that already contains personal or sensitive .md files). The script stages all *.md in that directory. - If you do not want remote pushes, leave ARTICLE_BOOKMARK_GITHUB unset — the script will skip remote operations. If you set ARTICLE_BOOKMARK_GITHUB, be aware the script will attempt to create and push a repo using your local 'gh' authentication. - The registry metadata inconsistency (marking ARTICLE_BOOKMARK_GITHUB and gh as required when they are actually optional) looks like documentation/config mismatch — confirm whether the skill really needs gh and a repo for your use. - Audit the content the agent writes before calling scripts/bookmark.sh save, and consider using a GitHub account/repo with limited privileges or a dedicated personal access token with narrowly scoped permissions. These points explain why the package is flagged as 'suspicious' rather than 'benign' — the behavior is coherent with bookmarking, but the env/binary requirements and the push/create-repo behavior increase the risk of accidental data exposure if misconfigured.