ghl

SUSPICIOUS. The stated HighLevel integration purpose is coherent, and the OAuth/data flows appear directionally consistent with the vendor service, but the skill’s actual execution depends on an opaque `/opt/hatch/bin/ghl` binary that is not publicly verifiable. Because that unverifiable CLI likely handles OAuth tokens and performs broad CRM/admin actions, the skill carries high supply-chain and credential-forwarding risk even without direct evidence of malicious exfiltration.