yuanbao

SUSPICIOUS: The skill is purpose-aligned for Yuanbao group interaction, but it grants the agent autonomous outbound messaging and DM capability with optional file transfer, and it hides the actual gateway endpoint behind implicit delivery. There is no strong malware evidence or supply-chain abuse in the provided skill, but the real-world action surface and opaque transport path make it medium/high risk.