otter

SUSPICIOUS. The skill’s high-level purpose is coherent, but it relies on raw Otter account credentials and an unverifiable unofficial API path even though Otter provides official API-key auth. Optional CRM sync is expected for the stated feature, but the missing script implementation leaves actual endpoints and credential handling unverified, raising medium-to-high security risk without proving confirmed malware.