candidate-sourcing

SUSPICIOUS: the skill’s capabilities mostly match its recruiting purpose, but it materially expands privacy and trust risk by harvesting personal emails from GitHub commit history, aggregating candidate PII into local trackers, and relying on MCP layers whose trust boundaries are only partly documented. Not confirmed malware, but medium security risk due to contact-data enrichment, third-party credential use, and semi-autonomous outreach preparation.