slack

SUSPICIOUS: the skill's core Slack functionality is coherent, and the `orth` CLI install path appears same-org and officially documented, but the data flow is mediated by Orthogonal rather than Slack directly. That makes Slack OAuth, channel metadata, and message history available to a third-party gateway, and the skill also enables outbound posting on the user's behalf. This is not confirmed malware, but it carries meaningful privacy and action-abuse risk.