api-client-generator

SUSPICIOUS: the skill is not overtly malicious and shows no explicit credential harvesting, exfiltration endpoint, or remote installer, but its broad auto-triggering scope and unrestricted bash permission are poorly aligned with a vague API client generation purpose. The main risk is disproportionate local execution capability without clear boundaries or documented data flows.