stuffed-toy-generator

SUSPICIOUS: the skill’s purpose and basic capabilities are coherent, but it routes all generation requests and the required credential through a third-party OneKey gateway rather than official provider APIs, and it suggests unpinned `npx` CLI execution with incompletely verifiable provenance. This looks more like a proxy integration than direct vendor access, creating meaningful trust and data-flow risk without clear evidence of outright malware.