handoff-notes

SUSPICIOUS: the skill’s purpose is coherent, but it routes support-ticket access through a third-party CLI/service instead of direct Gorgias APIs, creating moderate credential-forwarding and data-handling risk. No clear malware or hidden exfiltration is shown, but the external trust boundary and Bash-based execution make it higher risk than a direct API integration.