contact-research

SUSPICIOUS. The skill’s capabilities are broadly aligned with its stated purpose, but it relies on an unpinned external CLI (`npx ...@latest`) and forwards API credentials plus sensitive person-level data through vendor-controlled code. This looks more like a legitimate but medium-risk enrichment workflow than malware; the main concerns are mutable supply chain, credential forwarding, and large-scale PII handling.