kelly-wechat-crm

SUSPICIOUS: the skill's stated purpose and requested data are broadly coherent, but its core capability relies on a third-party external WeChat CLI installed via official yet risky download-execute scripts, plus transitive skill instructions. This is not confirmed malware, but it carries high supply-chain and privacy risk because sensitive local WeChat metadata is extracted by external code and then uploaded to Busabase.