social-media-posts-generator

SUSPICIOUS. The skill’s purpose and capabilities mostly align for image/carousel generation, but trust is concentrated in a third-party gateway that receives both credentials and user content, and the CLI example uses unpinned `npx` execution by a generic command name. No direct malware, exploit code, or covert behavior is present, but the intermediary data flow and mutable execution path make it higher risk than a normal direct API integration.