onboarding-kickoff

SUSPICIOUS: the business purpose is plausible and the named vendor credentials generally fit, but the skill routes sensitive inputs and API keys through opaque local scripts, leaves sheet/email endpoints undocumented, and enables autonomous external actions. Risk is driven more by incomplete trust and data-flow visibility than by confirmed malicious behavior.