blender-community-skill-bootstrap

SUSPICIOUS: the stated purpose matches the behavior, but the core action is transitive installation of third-party skills from a personal GitHub repository. Using official OpenAI installer/validator helpers and a pinned commit improves hygiene, yet the imported skill content remains externally sourced and effectively unreviewed, so overall risk is medium-high even without direct credential theft or malware indicators.