pm-search

SUSPICIOUS. The skill's market-research behavior and data flows are generally aligned with its purpose, and Exa/WebSearch fallback use is normal. However, the AnySearch dependency path is internally inconsistent: the install hint points to a different GitHub owner than the verified official AnySearch source, and the referenced `pip install anysearch` resolves to an unrelated package per the evidence. Because the skill then instructs the agent to execute that external CLI, this creates a significant supply-chain trust problem even without confirmed malware or overt exfiltration.