sorin-skill

SUSPICIOUS. The skill’s crypto-analysis purpose broadly matches its behavior, and the update path is same-org and user-confirmed, but the main runtime data flow sends the API key and queries to a proxy gateway on a less clearly documented domain instead of an obviously official first-party API endpoint. That proxy-based credential forwarding makes the skill higher risk than a normal documentation/integration skill, though not confirmed malicious.