content-cascade

SUSPICIOUS. The skill’s overall purpose is coherent, but it routes data and an API token through a community Apify actor, forwards a high-privilege Supabase service role key in direct API calls, and relies on unshown local scripts for transcript fetching and Twitter posting. This is not confirmed malware, but the credential scope and third-party trust are broader than ideal for a content-generation workflow.