deckset

SUSPICIOUS. The core behavior mostly fits a Deckset-authoring skill, and network calls go to official Deckset/GitHub endpoints rather than an obvious exfiltration service. However, the always-refresh design, credential forwarding to GitHub, and reliance on a gist ID whose ownership is not clearly verifiable make the footprint broader and less trustworthy than necessary for a presentation-formatting skill.