claude-music-random

SUSPICIOUS: The stated purpose is coherent for a music-generation helper, and its Bash/Read scope is proportionate, but the skill’s core function is delegated to an unverifiable local script outside the visible skill content. There is no direct credential theft or exfiltration shown here, yet the opaque executable dependency makes the install/execution trust footprint too large for a low-risk classification.