ai-director

SUSPICIOUS: The skill’s capabilities largely match its stated purpose and there is no strong malware signal, but it handles billable API credentials, stores them in local JSON files, and the actual network endpoints/publisher provenance are not fully verifiable from the provided evidence. This is best classified as a moderate-risk skill rather than malicious.