lobehub-cli

SUSPICIOUS. The skill largely matches its stated purpose and uses an official npm-distributed CLI, so there is no strong evidence of malware. However, it asks the agent to trust a broad external CLI for authentication, token storage, bot/provider secrets, device gateway functions, and transitive skill/plugin installation, which makes the overall security footprint high relative to a normal documentation skill.