shiplog

SUSPICIOUS/HIGH-RISK vulnerable skill, not confirmed malware. Its purpose and official data destinations are mostly coherent, but it forwards credentials and content through unverifiable local executables (especially ./secretcurl with XAI_API_KEY), which creates a black-box credential-forwarding and exfiltration risk that outweighs the otherwise legitimate workflow.