connect

SUSPICIOUS: the workflow matches the stated purpose, but the skill’s core trust dependency is an unverified `altitude` CLI that handles account pairing and likely receives device-flow credentials/session material. With no verified official distribution path or release provenance for that binary, this is a high supply-chain and credential-forwarding risk rather than confirmed malware.