omniverse-cad-to-simready

SUSPICIOUS. The skill's capabilities broadly fit its stated Omniverse CAD-to-SimReady orchestration purpose, and the NVIDIA publisher relationship lowers concern. However, trust is diluted by delegated shell execution through nested references, local upstream checkouts, Dockerized services, and forwarding of multiple provider credentials/tokens to auxiliary Content Agents or configured endpoints. This looks like a legitimate but high-trust orchestration skill with medium security risk rather than confirmed malware.

No explicit malicious code is evident in this fragment (no eval/exec, no obvious obfuscation, no explicit exfiltration/backdoor). The tool’s main risk is supply-chain/operational: it executes git/uv/pip and docker compose up/build, reads/writes credential-bearing env files, and performs network health/render probes to configured endpoints. If upstream specs or inputs are compromised, this could enable malicious code execution through the installed/deployed components. Confidence is limited because the snippet appears truncated in _dotenv_line_pair (possible code corruption).