deepapi

SUSPICIOUS: the skill’s broad purpose matches many listed capabilities, but it routes diverse tasks and potentially sensitive content through a single third-party service, including email, browser actions, VM execution, and memory. The biggest concern is install/update trust: official same-domain docs exist, yet the skill depends on local scripts obtained through an opaque setup flow and executes them in the background. No confirmed malware or credential theft is shown, but the data-flow centralization and updater model make this a high-risk skill.