iblai-vibe-monetization-onboard

SUSPICIOUS. The core Stripe Connect capabilities, credentials, and API destinations are coherent with the stated onboarding purpose, so there is no strong sign of malicious intent. Risk comes mainly from transitive skill installation through a third-party skills CLI and mutable raw GitHub bootstrap content, which broaden trust beyond a single reviewed skill.