iblai-vibe-agent-setting

SUSPICIOUS: The core capability fits the stated purpose and there is no clear credential theft or malicious data routing. The main concern is transitive trust: this single UI-tab skill instructs installation of additional skills from a repo-wide bundle, plus unpinned package/template setup steps. Overall this looks like a legitimate framework/integration skill with moderate supply-chain and trust-expansion risk, not malware.