osint

SUSPICIOUS. The external vendors cited are largely official and the install/provenance signals are mostly coherent, so this does not look like credential-harvesting malware. However, the skill’s actual footprint is disproportionate and high-risk: it mines private local communications and contacts, distributes personal data across sub-agents, and produces actionable dossiers/psychoprofiles on individuals with minimal user-friction. The main risk is autonomy and invasive surveillance capability, not supply-chain deception.

The code is a straightforward Apify API wrapper and contains no clear evidence of intentionally malicious behavior. It does handle a sensitive API token insecurely by placing it in URL query parameters and reads it from a local file. Input validation and URL/JSON encoding are incomplete, and the generic run operation allows arbitrary Apify actor execution, which can create privacy, authorization, and billing risks when invoked with untrusted input. Review and harden before exposing it as a general-purpose service.