upstash-box-remote-work

The skill’s remote development and publishing capabilities largely match its stated purpose, and the referenced services are consistent with that workflow. Main risks are remote credential exposure, public-by-default publication, broad command execution, and an unpinned third-party recording binary. No clear evidence of credential theft, concealment, or malicious intent; use user confirmation for public uploads, pushes, and API-key creation.