contact-sync

SUSPICIOUS. The business purpose is coherent, but the skill depends on a third-party CLI and routes customer data and provider access through Composio rather than directly to Gorgias and HubSpot. Because the installer appears official and the capability matches the stated sync task, this is not malicious, but the intermediary data flow and CLI trust model make it medium risk.