hex-sdk-patterns

SUSPICIOUS. The skill's purpose and capabilities are mostly coherent for a Hex SDK patterns guide, and data is intended to flow to official Hex endpoints. The main issue is the ambiguous, unpinned `hextoolkit` PyPI install: it is a supply-chain risk because the package provenance is not clearly verified as Hex-owned, yet it would receive `HEX_API_TOKEN`. No direct exfiltration, hidden behavior, or malicious mismatch is shown, so this is not malware, but it is a moderate security risk.