learn-voice

SUSPICIOUS: the skill’s purpose mostly matches its capabilities, but its core execution path relies on an unpinned third-party Docker image with transitive trust to unrelated publishers. That creates a substantial supply-chain risk even without clear evidence of credential theft or exfiltration.