google-maps-reviewer-contact-search

SUSPICIOUS: the skill’s scraping purpose is plausible, but its footprint expands via automatic installation of a separate Skill and CLI, plus explicit instructions to bypass separate user confirmation. The install sources appear same-org and more consistent with official distribution than a random payload, so this is not confirmed malware, but the autonomy and transitive-trust pattern make it a medium-risk skill.