competitor-ad-teardown

SUSPICIOUS. The stated purpose is coherent, and the credential scope is broadly proportionate, but the skill relies on opaque upstream scrapers and likely third-party Apify execution paths without naming or verifying the exact code that receives the API token. This is mainly a supply-chain and credential-forwarding trust problem, not confirmed malware.