product-photo-studio

SUSPICIOUS: the skill is broadly coherent with its stated purpose and uses first-party Beatra endpoints, but it carries meaningful security risk because it installs from GitHub rather than an official registry, stores a shared bearer token with spend scope, uploads user media/prompts to a paid third-party service, and includes mandatory telemetry plus possible .cn routing. This looks like a legitimate but high-trust hosted-service integration, not confirmed malware.