hands-free

SUSPICIOUS. The stated purpose and core capability are aligned, but the skill delegates key behavior to an unseen call bridge script, requires telephony credentials, and enables autonomous phone-call actions. The npm-based install path is a moderate supply-chain risk, and the absence of endpoint/provenance details prevents a benign classification.