invoice-generator

SUSPICIOUS: the skill’s stated purpose is benign, but its actual footprint is under-specified and broader than necessary due to unrestricted Bash access. No direct credential theft or malicious payload is shown, yet third-party distribution without clear integrity signals and excessive command scope make it medium risk rather than benign.