perfectpixel

SUSPICIOUS: the skill’s stated purpose matches sprite generation, but it relies on a shell-installed external CLI, mutable versioning, and credential forwarding to that CLI. Same-repo source visibility prevents a malicious classification, yet install-trust and provider data-flow ambiguity keep the security risk in the medium range.