artifact-fail

SUSPICIOUS: the skill’s core behavior matches its stated publishing purpose, and its permissions are otherwise narrow. The main issue is data-flow integrity: both content and bearer token are sent to an endpoint entirely controlled by ARTIFACT_FAIL_ENDPOINT rather than a fixed official service domain, creating medium risk of misrouting credentials or posting to an unintended host.