portal-external-app

SUSPICIOUS: the skill’s purpose and capabilities mostly align, and the flagged curl is benign documentation. However, it requires private Docker images and internal tooling whose provenance cannot be independently verified from the skill, and those artifacts handle credentials/secrets during setup; that makes the install/execution trust footprint high even without direct exfiltration evidence.