ai-music-generation

SUSPICIOUS: the skill’s purpose is coherent, but it expands trust beyond that purpose through transitive skill installation, broad belt shell permissions, and dependence on an external CLI/install chain with inconsistent publisher naming. Data flows are mostly aligned with music generation, so this is not confirmed malware, but it carries meaningful supply-chain and credential-forwarding risk.