goodissues

SUSPICIOUS: The stated purpose is coherent, but the skill's trust model is weak. It asks the agent/user to install and use an externally delivered CLI via remote scripts, then pass API keys into that binary, with optional routing to arbitrary `--url` endpoints. This is not confirmed malware, but it is a high supply-chain and credential-forwarding risk unless the CLI provenance and official install path are independently verified.