niche-scout

SUSPICIOUS: the skill’s overall purpose is coherent, and its external services match KDP niche research, but trust is weakened by unreviewable local scripts, possible reading of ~/.zshrc, explicit mention of hardcoded credentials, and reliance on a community-owned Apify scraper actor rather than a clearly official same-org integration. This looks more like a risky/opaque automation than confirmed malware.