sgdk-audio

SUSPICIOUS. The skill’s audio guidance and local asset generator align with its stated purpose, and the flagged command patterns are benign documentation examples. The main risk is install/execution trust: it directs the agent to run a third-party Docker image from a namespace that does not match the official SGDK publisher, using an unpinned mutable latest tag, even though an official same-org SGDK container exists. That makes the skill internally inconsistent on toolchain provenance, but there is no clear evidence of malware or credential theft.