dd-orchestrator

SUSPICIOUS. The Datadog purpose broadly matches the Datadog API usage and onboarding flow, but the skill’s footprint is too trust-expansive for an orchestrator: it reads raw credentials, writes telemetry, and most importantly fetches and executes other skills from mutable unpinned sources. The silent internal actions and transitive skill execution meaningfully elevate risk even without evidence of outright malicious exfiltration.