local-search

SUSPICIOUS. The skill’s search capabilities match its stated purpose, and the install path appears to use official npm/docs for the same publisher ecosystem. However, it proxies Google Maps access through a third-party paid wrapper, requires a wallet/payment client for a search task, uses unpinned `npx @latest`, and can spend funds autonomously on API calls. This is not confirmed malware, but the install trust and indirect data/payment flows make it higher risk than a normal direct API integration.