lovstudio-xbti-creator

SUSPICIOUS: mostly purpose-aligned website scaffolding, but it silently installs extra tooling, chains trust into another skill/CLI, forwards an API key to that installed code, and can autonomously create a public GitHub PR. The footprint is somewhat disproportionate to a content-generator skill, with medium-to-high supply-chain and autonomy risk but no confirmed malware or obvious credential-harvesting flow.