person-lookup

SUSPICIOUS. The skill’s purpose matches person lookup, but its data flow is not direct: although it claims to use Nyne, all documented calls go through Orthogonal’s api.orth.sh gateway with an Orthogonal API key. That intermediary routing is a material integrity concern because credentials and person-search data are sent to a broker rather than the named provider. The orth CLI provenance also remains unclear from the provided evidence, though the curl path avoids mandatory reliance on the CLI. Overall this looks more like a brokered OSINT/people-search integration than direct Nyne access; risk is driven by third-party credential forwarding and privacy-sensitive data handling, not confirmed malware.