olostep

SUSPICIOUS. The Olostep capability set is broadly coherent with a scraping/crawling skill and official docs support direct API use to Olostep domains, so this is not strong evidence of malware. However, the skill's actual execution path depends on an unverifiable `orth` CLI not documented or provenance-checked in the provided material, which triggers a high install-trust concern; the optional arbitrary `webhook_url` and remote autonomous browsing add moderate data-flow risk.