character-design-sheet

SUSPICIOUS: The skill’s image-generation purpose is coherent, but its footprint includes transitive skill installation, mutable raw GitHub install docs, and credential use through an external CLI. This looks more like a legitimate but higher-trust workflow than malware; the main concerns are supply-chain expansion and credential forwarding rather than clear exfiltration or deception.