neta-adventure

SUSPICIOUS. The skill's purpose and capabilities are mostly aligned for a hosted adventure-campaign service, but it relies on executing an unpinned npm package via npx @latest, so the main risk is supply-chain trust and opaque backend/data handling rather than clear malicious behavior.