cvat-pull

SUSPICIOUS. The purpose is coherent, and the requested CVAT token is proportionate, but the skill relies on undocumented third-party yolo-* executables with no verified install source or release provenance. Because a nonstandard CLI likely receives the CVAT access token and mediates network/data transfer, the skill has high supply-chain and credential-forwarding risk despite otherwise plausible workflow steps.