nsfw-ai-spicyapi

SUSPICIOUS. The skill’s core capability and data flows fit its stated SpicyAPI purpose, and its official endpoint/API-key usage are proportionate. The main concern is install trust: it asks the agent to clone and run an external Python script from an older repo/org that does not match the vendor’s current documented distribution path, so provenance is only partially verified even though the commit is pinned and no obvious exfiltration beyond SpicyAPI is described.