g2b-sanctioned-supplier

SUSPICIOUS: the publisher relationship for the CLI appears consistent, so this is not confirmed malware, but the skill’s actual footprint is broader and more mutable than its narrow lookup purpose suggests. Main concerns are runtime delegation to remote instructions, transitive trust in the CLI/update path, and proxy-mediated data flow instead of direct official API access.