rombot-community

SUSPICIOUS. The stated purpose is coherent, but trust and data-flow controls are weak: a manually issued token, a non-public local helper script, and a configurable API URL mean credentials and user queries may be forwarded to an unverifiable endpoint. This looks more like a custom private integration than clear malware, but it is higher-risk than a normal documented API skill.