company-funding-search

SUSPICIOUS: The skill’s purpose matches its funding-search behavior, and the Gooseworks CLI/API appear same-org and plausibly legitimate. However, it directly reads a local credential file and forwards the token through a proxy API, with some uncertainty around the direct `orth.sh` endpoint relationship; this makes the skill moderately risky but not malicious.