geo-visibility-check

SUSPICIOUS. The core purpose and Xpoz data flows are mostly coherent and same-org, but the skill overreaches by asking users to paste credentials into chat and by instructing the agent to fetch or rely on another mutable remote skill. This is not confirmed malware, but it has medium security risk from credential handling and transitive trust.