toy-generator

SUSPICIOUS: the skill's toy-generation purpose is coherent, but its data flow routes all prompts and the required credential through a DeepNLP gateway instead of official provider APIs, and its recommended `npx onekey` CLI path has unresolved package provenance. This is not confirmed malware, but it carries meaningful intermediary trust and credential-forwarding risk.