iblai-api-login

SUSPICIOUS. The skill’s purpose broadly matches its ibl.ai login/bootstrap role, and data appears to stay within ibl.ai domains, so it is not clearly malicious. However, it instructs the agent to extract a browser session token from localStorage, use it to mint a long-lived API credential, and write that secret to .env for reuse by other skills; combined with endpoint/documentation inconsistency (api.iblai.app vs platform.iblai.app), this is a meaningful credential-handling risk.