pp-openart

SUSPICIOUS. The skill's capabilities mostly match its stated OpenArt automation purpose, but it depends on unofficial third-party CLI/MCP tooling, uses browser-cookie auth, includes stale install guidance, and supports arbitrary webhook delivery. These are proportionate enough to avoid a malware label, but the combined trust-chain and data-flow risks make it medium/high risk.