capx-agentic-robotics

SUSPICIOUS. The main CaP-X setup appears aligned with the stated robotics purpose and uses a real same-project GitHub source, so this is not confirmed malware. Risk comes from real-world robot actuation, external model/service data flows, and especially the companion `npx skills add broomva/skills` instructions, which introduce transitive skill-install trust outside the core CaP-X repo. Overall this is a coherent but high-impact robotics skill with medium security risk rather than a deceptive credential-harvesting skill.