gmail-automation

SUSPICIOUS rather than malicious. The skill's capabilities mostly match its Gmail purpose, but trust is weakened by opaque local scripts from a personal publisher, unclear token-refresh wording that diverges from official Google OAuth flow, and autonomous email-sending capability. No direct evidence of credential theft or malicious exfiltration is shown, but the install/execution trust and data-flow ambiguity make it medium risk.