maishou

SUSPICIOUS: the skill’s basic purpose is plausible, and its package installs are mostly normal, but its core data flow depends on an unverified third-party aggregator domain rather than official marketplace APIs. The absence of visible credential harvesting keeps malware likelihood low, yet the intermediary routing and possible lack of HTTPS make the skill a medium security risk.