niche-scout

SUSPICIOUS. The stated purpose matches the capability: market research using keyword and BSR data. Data flows mostly align with official DataForSEO and Apify APIs, but the skill forwards credentials to external services, relies on a third-party Apify actor outside the publisher’s org, and references local scripts whose code was not provided for review. The 'hardcoded or ~/.zshrc' credential guidance is disproportionate and weakens trust. This is not confirmed malware, but it carries medium security risk due to opaque external processing and unverifiable script behavior.