mention-radar

SUSPICIOUS: The skill’s purpose and official API usage are mostly coherent, and there is no clear malicious data diversion. However, its core execution depends on opaque local helpers (especially ./secretcurl receiving XAI_API_KEY), which makes credential handling and runtime behavior insufficiently verifiable; that pushes overall risk above benign.