lov-event-poster

SUSPICIOUS due to transitive installation and an opaque encrypted payload, but not clearly malicious. The workflow appears to be an official Lovstudio paid-skill mechanism; the main concerns are external CLI execution, unpinned package retrieval, and inability to audit the decrypted skill before trust is granted.