phone-verification

SUSPICIOUS: The skill's purpose is plausible, but its actual data flow is not aligned with the plain-language claim of verifying via the Didit API because it routes sensitive phone and OTP data through Orthogonal instead of Didit's official direct endpoint. Credential scope is limited, so this is not confirmed malware, but the intermediary routing and unverified CLI provenance make the skill medium risk.