clawfinder

SUSPICIOUS: the skill is broadly aligned with its stated purpose and does not show clear credential theft, but it expands agent capability into external messaging, arbitrary attachment retrieval, and payment-related actions. The main risks are untrusted content handling and real-world transaction automation, not overt malware.