gtm-tools

SUSPICIOUS. The skill is broadly aligned with a sales-automation API, but it carries meaningful risk: remote pipe-to-shell installation, autonomous API self-registration, browser-session-backed social actions, and financial top-up operations. Data flows appear to the claimed service domain rather than an obvious exfiltration host, so this is not confirmed malware, but the operational footprint is high-risk for an agent skill.