lovstudio-fill-web-form

SUSPICIOUS: The skill's core behavior mostly matches its stated purpose, and it has no installer or credential-forwarding red flags. However, it combines arbitrary URL fetching with broad local knowledge-base search and write capability, creating indirect prompt-injection and privacy leakage risk, especially through the mandatory inspected-files tree.