pruna-api

SUSPICIOUS. The core API/upload/download behavior is coherent and routes data only to official Pruna and Replicate endpoints, so there is no strong evidence of credential harvesting or malware. The main issue is transitive trust: this skill repeatedly instructs the agent to install additional skills and a full suite via an unpinned remote skills mechanism, which broadens the trust chain beyond what is necessary for a simple API reference.