customer-discovery

SUSPICIOUS: The core purpose is coherent, but the skill carries medium risk because it executes local and transitive external scripts, may forward third-party API credentials to those scripts, and processes large volumes of untrusted web content with write/exec capability. No clear malware or explicit exfiltration is present, but the transitive-trust and prompt-injection surfaces are significant.