gooseworks-master

SUSPICIOUS. The skill’s purpose broadly matches data gathering, but its actual footprint is much larger: it reads local credentials, pulls remote instructions/scripts/files, installs dependencies, executes fetched code, and chains additional dependency skills. The Orthogonal proxy also routes API calls through GooseWorks instead of direct provider endpoints, creating intermediary data-flow and trust concerns. This is not confirmed malware, but it is a high-risk meta-skill with significant supply-chain and transitive-trust exposure.