perfectpixel

SUSPICIOUS. The stated purpose is coherent with sprite generation and provider API use, and the referenced repo appears same-org, but the skill expands trust to a custom `ppgen` binary installed by script and then forwards local credentials/auth to it. The data access is mostly purpose-aligned, yet installer/release verification is incomplete and the binary is the main trust bottleneck, so this is better classified as medium-high supply-chain/security risk rather than confirmed malware.

This module is a standard bootstrap/install script that downloads or builds a Go-based binary and then executes it for validation. There is no cryptographic integrity verification of the downloaded release binary, no pinning of git source to a specific commit/tag, and the validation step itself executes the candidate binary. While there is no direct evidence of malicious behavior in the shell script (no backdoor mechanisms, no exfiltration logic), the supply-chain risk is meaningful because attacker-controlled binaries/source could be executed during installation via valid().