ai-chatbot

SUSPICIOUS: The skill’s capabilities mostly fit its stated purpose as a chatbot template setup/deploy guide, and data flows go to expected official services. The main risk is supply-chain trust: it bootstraps from an unverified third-party GitHub template and then runs pnpm install, while also forwarding local env vars to hosting CLIs. The rm -rf findings are routine cleanup, not malware indicators.