entropy-box

SUSPICIOUS. The skill's capabilities largely match its stated purpose and it contains strong safety guidance, so it does not look malicious. However, its live data flow depends on a third-party ngrok-hosted API, and external integration docs include downloading and running a raw Python server from that host without strong release verification; this makes the install/data-trust posture weaker than the polished documentation suggests.