lov-subtitle-freedom

SUSPICIOUS. The stated subtitle purpose is benign, and the install path appears tied to the same Lovstudio ecosystem through npm/PyPI rather than random hosts. However, the skill’s actual content is encrypted and only decrypted in memory by a helper, so its real capabilities, permissions, and data flows cannot be independently verified before execution. This hidden-behavior model is not strong evidence of malware, but it creates meaningful trust and reviewability risk.