linkedin-post-generator

SUSPICIOUS. The core purpose is plausible, and local style/source files are proportionate, but the skill’s actual footprint extends into transitive plugin installation and execution of unverified sibling scripts that receive sensitive workspace data and credentials. The LinkedIn scraping path uses a third-party scraping skill rather than an official API, and the plugin identifiers/provenance are not fully verifiable from the evidence. This is not confirmed malware, but it is a high security-risk skill because confidential internal content and integration tokens flow through third-party/local plugin code outside the skill itself.