cli-anything-novita

SUSPICIOUS. The skill's purpose and requested credential are broadly consistent with a Novita API client, and the Novita service itself appears legitimate. But the installation instructions are internally inconsistent with the known official docs, the advertised PyPI package is not verifiable, and the package identity appears to have shifted across names/repos. This is more a provenance and supply-chain trust problem than confirmed malicious behavior.