VLM

SUSPICIOUS. The skill’s stated vision-chat purpose is coherent, and the SKILL.md itself is mostly normal documentation, but it relies on a weakly verifiable third-party SDK/CLI that handles API credentials and can send them to a configurable endpoint. That combination makes the skill high risk even without confirmed malicious code in the markdown.