universal-modder

SUSPICIOUS. The skill’s capabilities mostly fit its modding purpose and its data-flow guidance is relatively well-scoped, but install trust is weaker because the usable path depends on a third-party bundle installer and an externally supplied local CLI rather than a clearly verified upstream package route in the skill itself. Main risk is supply-chain and local command execution, not confirmed malware or credential theft.

SUSPICIOUS: the skill is broadly coherent with its stated game-modding purpose, and its hard rules reduce obvious abuse, but it grants a wide reverse-engineering and local-automation footprint and depends on a GitHub-installed external CLI. This looks more like a high-risk modding/RE workflow than outright malware: internally aligned, but with meaningful supply-chain and capability risk.