person-dossier

The skill’s behavior matches its stated purpose, but it depends on opaque CLIs that handle sensitive communications and at least one leased API token. Because those binaries are not verifiably sourced here and receive credentialed access to private data, this is best classified as suspicious/high-risk rather than benign or confirmed malware.