places

SUSPICIOUS. The runtime data flow and credential use are mostly consistent with a place lookup skill, but install trust is weakened by unpinned installation from a personal GitHub repo, mutable third-party registry usage, and explicit transitive installation of many companion skills. No strong evidence of credential theft or malicious exfiltration in the provided content.