web-search

Purpose and capabilities mostly align for a search skill, and the install path appears same-org and official. Main concern is data-flow integrity: the skill reads a local API key and sends all searches through a Gooseworks proxy gateway instead of official vendor endpoints, so queries and access tokens are exposed to an intermediary by design. Overall this is better classified as suspicious/medium-risk than malicious.