radar

SUSPICIOUS. The skill’s messaging purpose broadly matches its capabilities, and the external endpoints appear consistent with official Telegram/Gmail/Google services. However, it handles raw credentials, embeds a Telegram token in a script, relies on unverifiable custom local helpers/internal MCP components, and enables autonomous outbound messaging/document delivery from task text. This is high operational risk but not confirmed malware.