instagram-post-generator

SUSPICIOUS. The skill's core function matches its description, but it depends on a third-party gateway and hosted workspace stack that receives the user’s content and required credential, rather than using official platform APIs directly. The unpinned `npx` CLI path adds supply-chain risk. This looks more like a gateway-backed SaaS integration than overt malware, but the intermediary credential/data routing and mutable execution path make it medium risk.