catalyst-orchestrator

SUSPICIOUS. The skill’s capabilities mostly match its stated marketing-orchestration purpose and it does not request credentials or route data to off-platform endpoints, so there is no strong evidence of malware. The main concern is install trust: this skill name appears from multiple publishers and the public install path relies on third-party CLI plus mutable repo content without strong release verification, which makes provenance ambiguous.