copycat

SUSPICIOUS. The stated product-discovery purpose is coherent, and the skill avoids obvious credential theft or direct exfiltration instructions. However, its core behavior depends on undocumented external copycat-* tools and an unseen local script, so provenance and actual data flows cannot be verified; combined with broad ingestion of untrusted web content, this creates medium-high security risk.