viral-script-free

SUSPICIOUS. The free skill’s core local transcript analysis is broadly consistent with its stated offline purpose, but it embeds an optional transitive purchase/install flow for a different paid skill using unpinned `npx @latest`. Because that external flow is on Alipay-owned infrastructure and requires user payment confirmation, this is not confirmed malware; it is a medium-risk trust and scope expansion inside an otherwise offline skill.