medium

SUSPICIOUS: the skill's capabilities largely match its stated Medium purpose, and there is no notable remote installer or obvious third-party exfiltration endpoint. However, it depends on captured session cookies and Medium's internal web APIs rather than an official auth/integration flow, and it enables real public posting on the user's account. This is coherent but high-trust and moderately risky.