sorted

SUSPICIOUS: The skill is purpose-aligned with invoicing/tax automation, but its footprint is high-risk because it can perform consequential financial submissions and outbound communications using a persisted authenticated browser and local Telegram credentials. Install trust is mixed but not overtly malicious; the main issue is disproportionate operational risk and sensitive-account automation, not confirmed malware.