google-maps-list-builder

SUSPICIOUS: the skill is internally consistent for lead-list building and uses ordinary npm installs, but it routes requests and the API key through a third-party RapidAPI provider rather than official Google APIs, and it explicitly chains into other skills for enrichment. This is not confirmed malware, but it carries medium risk from third-party data/credential flow and transitive-skill trust.