caveman-discover

SUSPICIOUS: the skill's purpose mostly matches its behavior, but it extends third-party gateway usage into more code paths, inherits trust from another setup skill, and sits adjacent to API-key-bearing headers. No direct credential theft or hidden exfiltration is present, but transitive trust and ecosystem install/provenance ambiguity raise medium security concern.