lovable

SUSPICIOUS. The skill is mostly aligned with its stated Lovable-integration purpose and shows no malicious download, credential theft, or exfiltration behavior. The main risk is autonomous real-world backend deployment through YOLO mode plus transitive trust in a separate yolo skill, which weakens normal approval safeguards even though it remains scoped to Lovable operations.