flowdriver-covert-transport

SUSPICIOUS: the skill’s footprint is coherent with its stated purpose, but that purpose is covert network evasion. It routes arbitrary SOCKS5 traffic through Google Drive, copies OAuth tokens to a remote server, and builds/runs third-party code from an unrelated publisher source. This is not confirmed malware, but it is a high-risk tunneling skill with disproportionate misuse potential and credential-forwarding concerns.