creator-scraper-cv

The skill is mostly coherent with its stated CreatiVault creator-discovery/outreach purpose and routes data to matching official service domains, so there is no strong evidence of malware or unrelated exfiltration. Risk is driven by autonomous email outreach, local identity-file use, and the optional remote auto-update mechanism, making it suspicious/high-risk as an agent skill but not malicious.

SUSPICIOUS: the workflow purpose mostly matches its capabilities, and the service/domain relationship looks same-org, but this layer inherits significant trust from child skills, coordinates real-world outreach actions, and the documented CreatiVault API base uses HTTP rather than HTTPS. Not confirmed malware, but medium security risk due to transport integrity and transitive workflow trust.