pp-fish-audio

The skill is purpose-aligned with Fish Audio automation and mainly uses publisher-controlled install sources, so it is not confirmed malicious. However, it expands scope beyond simple API use by requiring a wrapper CLI that stores credentials locally, maintains a self-learning journal, can background hidden write actions, and can POST outputs to arbitrary webhook URLs; combined with the mutable `go install @latest` fallback, this makes the skill suspicious/moderate-risk rather than benign.