kol-discovery

SUSPICIOUS. The skill's purpose and capabilities mostly align, but it depends on a third-party community Apify actor with unpinned provenance and forwards an API token to external hosted execution. This is a moderate supply-chain and credential-forwarding risk, not confirmed malware.