cawplan-product-insights

SUSPICIOUS. The skill’s purpose and commands are internally coherent for product-insight retrieval, and there is no clear exfiltration or hidden-action behavior in the visible instructions. However, it relies on an external `cawplan` CLI whose provenance is not publicly well-verified, so the main risk is supply-chain trust in a black-box dependency rather than confirmed malicious behavior.