merch-design

SUSPICIOUS: the core merch-design purpose is benign and the capabilities mostly fit, but the documented API flow is not clean. The main risk is credential and brand-asset routing through a third-party OpenAI-compatible gateway rather than the official API, which weakens data-flow integrity even though there is no clear malware or malicious execution behavior in the skill text itself.