kai-gtm-pack

SUSPICIOUS. The skill’s core capabilities fit its stated purpose, but it packages potentially sensitive client materials into hosted pages using weak privacy conventions, and it references unspecified plugin installs/scripts whose provenance is not verifiable from the skill. This looks more like a risky delivery workflow than malware: coherent purpose, medium security risk, low evidence of malicious intent.