visual-artifact

SUSPICIOUS: the skill’s purpose and data flows are broadly coherent for artifact rendering and optional Cloudflare publishing, but it depends on an unverifiable compiled CLI and allows that CLI to receive Cloudflare credentials. That combination makes the skill high risk despite no clear evidence of intentional malware or off-purpose exfiltration.