pokemon-player

SUSPICIOUS. The core behavior matches the stated purpose of automated Pokemon play, so this is not outright malicious, but the skill increases risk by cloning and executing a mutable GitHub repo and by opening a public localhost.run reverse tunnel to a local service. Those choices are broader than necessary for simple local gameplay and warrant caution, though there is no strong sign of credential theft or hidden exfiltration.