oransim-causal-marketing-twin

SUSPICIOUS. The skill’s capabilities mostly fit its stated purpose as a local causal marketing simulator, and its data flows are largely coherent. However, trust is weakened by the provenance mismatch between the skill publisher (ara.so) and the install source (OranAi-Ltd GitHub), plus source-based editable installation and optional credential routing to arbitrary LLM base URLs. No direct credential harvesting, hidden exfiltration, or overtly malicious behavior is shown.