render

SUSPICIOUS: the skill’s purpose and capabilities mostly align, and the CLI provenance appears same-org and source-visible, so this is not strong malware evidence. However, the integration routes Render access and tokens through ClawLink as a third-party intermediary and enables write actions on infrastructure, creating medium security risk from credential mediation and indirect data flow.