viral-app

SUSPICIOUS. The skill’s purpose, endpoints, and API-key model largely match viral.app, and the scanner finding itself is benign documentation text. But the skill requires a standalone `viral-app` CLI that could not be verified as an official documented artifact, and that binary is expected to receive `VIRAL_API_KEY` and perform privileged API calls. Under the mandatory dependency rules, an unverified credential-bearing CLI makes this a high security-risk skill even without evidence of confirmed malware.