gtm-plays-11

SUSPICIOUS. The skill’s purpose and capabilities mostly align as a GTM playbook, but it includes an unpinned `npx` download-and-execute path and forwards an API key to third-party MCP code. Data flows are broadly consistent with prospecting rather than overt theft, so this is better classified as medium supply-chain/credential-forwarding risk than malware.