muapi-product-campaign

SUSPICIOUS. The skill’s capabilities mostly match its stated marketing-asset purpose and data flows go to official MuAPI endpoints, but it forwards API credentials to an external CLI with incomplete same-org provenance and no pinning. Risk is driven by install trust and credential forwarding rather than overtly malicious behavior.