kakao-map

SUSPICIOUS: the skill’s purpose is coherent, but its actual footprint is broader than a normal API integration because it defers instructions to a remote CLI and routes map queries through a publisher-hosted proxy using operator credentials. Same-org npm/GitHub/domain evidence lowers the chance of outright malware, yet mutable remote instructions, loose version pinning, and intermediary data flow make this medium risk rather than benign.