speak

SUSPICIOUS. The skill’s core behavior matches its stated TTS purpose, but it depends on a third-party MCP server and forwards cloud-provider API keys through that server instead of calling official provider APIs directly. This is a coherent utility skill with moderate supply-chain and credential-forwarding risk, not clear malware.