lov-cli2anything

SUSPICIOUS: the stated purpose and capabilities mostly align, and the instructions include sensible limits on authorization and secret handling. However, the core bundled cli2anything++ runtime is not externally verifiable from the provided evidence, so install/execution trust is disproportionately weak for a skill that can ingest sensitive session-derived API evidence and generate runnable artifacts.

No clear malicious payload or malware behavior is present. The code implements an extension-backed local HTTP proxy. The principal risks are an unauthenticated loopback API, wildcard CORS, unrestricted proxy URLs and request data, forged result submission if identifiers are obtained, and unbounded request-body buffering. URL allowlisting, authentication or per-session tokens, strict Origin validation, result schema validation, and body-size limits are recommended.