outreach-push

SUSPICIOUS: the skill's core behavior matches its stated purpose, but it is inherently high-impact because it can trigger automatic outreach to real contacts. The explicit approval gate and suppression/consent checks are positive, yet reliance on MetaMCP as an intermediary plus transitive MCP package execution raises medium trust and data-flow risk rather than indicating confirmed malware.