free-keys

SUSPICIOUS: the skill’s main behavior fits its stated purpose, but it is high-trust automation that collects many API keys, performs automatic browser/service actions, edits multiple config files, and includes web-search-driven discovery with write/exec capability. Data flows appear mostly direct to official providers rather than an attacker proxy, so this is not confirmed malicious, but the scope and credential concentration make it risky.