happyhorse

Mostly coherent media-generation skill, but it requires trusting the inference.sh `belt` CLI, references a raw GitHub install document, and encourages transitive installation of additional skills. No strong evidence of malware or credential theft is present, but the external CLI trust chain makes this medium security risk rather than fully benign.