scry

SUSPICIOUS: mostly coherent with a legitimate Scry API integration, and data flows appear to stay on official Scry domains. The main concerns are overbroad scope for a search skill (billing/wallet/payment flows), transitive `npx` skill installation/update instructions, and exposure to prompt-injection content from external corpora; these raise security risk but do not show confirmed malware or credential theft.