data-import

SUSPICIOUS. The stated purpose is coherent with data import and platform writes, and the approval gate is a meaningful control, but the actual execution path is under-specified: imports are funneled through unnamed MCP servers and an unverifiable local competitor-tracker.py script. This is not confirmed malware, but it has medium risk due to opaque trust boundaries, external data transmission, and broad write capability across connected platforms.