tgw-search

This skill is mostly coherent with its stated purpose: public web search via Perplexity and Tavily, explicit trigger-only use, and warnings not to commit API keys. The main risk is trust in the unreviewed local script that receives user secrets and performs network requests, plus local file-based key storage. No direct evidence of malware or deliberate exfiltration is shown, but the missing script content keeps this in suspicious/medium-risk territory rather than benign.