selling-point-infographic

SUSPICIOUS. The skill’s core purpose is coherent, but its data flows are not: it steers prompts, product images, and potentially API keys through unrelated third-party services instead of official vendor endpoints. That makes it a medium-high security risk driven by credential forwarding and intermediary exfiltration concerns, not confirmed malware.