blackbox

SUSPICIOUS: the skill's purpose matches delegated coding via an external CLI, but trust is weakened by package-name mismatch with official docs, limited verifiable release provenance, and remote forwarding of prompts/code through third-party tooling. The behavior is not clearly malicious, yet the install trust and external data-routing risks are too high to treat as benign.