openai

SUSPICIOUS: the skill is internally consistent and uses a verifiable npm-distributed CLI, but its actual access model depends on ClawLink as a credential-holding intermediary rather than direct OpenAI API use. The main risk is third-party credential/data brokerage and broad action capability, not confirmed malware.