add-tts-engine

SUSPICIOUS: the skill’s purpose and capabilities mostly align with legitimate developer work, but it asks the agent to clone and evaluate arbitrary third-party model code and dependencies, then incorporate resulting changes into the project. There is no clear credential theft or exfiltration, so this is not malware, but the unpinned external dependency workflow and untrusted-content processing create meaningful medium security risk.