people-property

SUSPICIOUS. The skill’s capabilities largely match its stated purpose, and the `npx agentcash` install path appears consistent with official documentation. However, it sends highly sensitive personal-lookup data to a third-party intermediary (`stableenrich.dev`) and relies on a mutable `@latest` CLI download, creating medium privacy and supply-chain risk even without clear evidence of malicious intent.