present

SUSPICIOUS: the skill’s core capabilities mostly match its stated purpose, and its implied external services are legitimate, but it forwards credentials and content through local helper scripts from other skills whose code and provenance are not shown. That creates medium supply-chain and credential-forwarding risk, plus some autonomy risk from optional auto-deploy, without enough evidence for confirmed malware.