image-stats

SUSPICIOUS: the core capability is aligned with its purpose and direct API data flow is mostly coherent, but two integrity issues raise concern: it auto-provisions a bearer token from a remote endpoint, and LABNOCTURNE_BASE_URL can redirect authenticated requests to an arbitrary host. The skill is not clearly malicious, but it has medium security risk due to credential handling and install trust.