character-design-sheet

SUSPICIOUS. The skill’s image-generation purpose matches its capabilities, and data flow appears directed to the expected inference.sh ecosystem. However, it relies on transitive skill installation and an external CLI installed via same-org but higher-risk mechanisms (npx skill add, curl|sh, mutable latest), with login credentials handled by that CLI. This is not clearly malicious, but the install and trust model is broader than a simple documentation skill.