spriterrific-api

SUSPICIOUS: the skill's capabilities mostly match its stated purpose as a hosted sprite-generation API client, but trust is weakened because it routes bearer tokens to a Convex-hosted domain rather than clearly to the app domain, and it recommends ZIP-based self-updates from GitHub releases. This is not confirmed malware, but the credential/data flow and update path are not fully proportionate or verifiably same-origin from the provided evidence.