crabbox

SUSPICIOUS: the skill’s core purpose is coherent, and the same-org Crabbox tooling appears legitimate, but the overall footprint is high-trust and expansive. It forwards secrets to remote environments, syncs repo data off-host, supports SSH/desktop control, and relies on an official yet third-party Blacksmith CLI installed via curl|sh with auto-update. This looks more like a powerful remote orchestration skill than malware, but it carries meaningful security risk and should only be used with tightly controlled credentials and explicit user intent.