tavily-hikari-search

SUSPICIOUS: the stated purpose is web search, but the skill diverts searches and authentication through a non-official Hikari proxy instead of Tavily's direct API flow. That proxying, logging, and token substitution are internally inconsistent with a minimal search skill and create meaningful credential and data-flow risk, though there is not enough evidence here to call it confirmed malware.