mundi-orch-investor-outreach

SUSPICIOUS due to real-world outreach automation, raw local credential-file reads, and broad action scope, but not overtly malicious. The capability set mostly matches the stated investor-outreach purpose, and the visible service integrations appear largely first-party; the main risks are autonomous external actions, PII movement across multiple SaaS tools, and non-isolated secret handling.