oma-slide

Suspicious rather than malicious. The skill’s slide-generation and export capabilities fit its stated purpose, and Canva traffic targets an official endpoint, but the required `oma slide` CLI is not verifiable from the skill text and therefore triggers a high supply-chain risk floor. Remote style ingestion plus file-write/tool-exec capability further raises risk, though there is no clear credential harvesting or covert exfiltration behavior.