speak-deploy-integration

SUSPICIOUS. The visible purpose and direct API data flow are mostly coherent, and there is no clear malware or exfiltration behavior. However, the skill is under-specified, grants broader shell permissions than its narrow task needs, depends on a prerequisite skill, and relies on an SDK/package whose official provenance is not established in the provided evidence.

No clear malicious or supply-chain attack behavior is present. The material is a deployment guide with expected secret handling and cloud deployment commands. Security review is warranted because Cloud Run is unauthenticated, speech endpoints allow wildcard CORS, request parameters lack validation and abuse controls, and the health endpoint may expose operational or error information. Webhook verification and audio-storage security are not implemented in the supplied fragment.