mobile-automation

SUSPICIOUS: the skill’s capabilities mostly match its stated mobile-automation purpose, and the upstream package appears same-org and publicly documented, so this is not strong evidence of malware. Risk is medium because it enables autonomous control of real devices, may accept cloud-service credentials, and appears to rely on mutable npx execution with incomplete disclosure of the broader dependency/trust chain.