outreach-4-categories

SUSPICIOUS: the stated purpose is mostly benign sales-taxonomy guidance, but it embeds a high-risk execution path by telling the agent/user to run an unpinned `npx` installer and pass an API key into a package whose npm provenance was not verified from the evidence. Same-org API usage is coherent with the purpose, but the install/credential-forwarding footprint is disproportionate for a taxonomy skill and triggers the unverifiable-binary-with-credentials risk floor.