social-media-content-plan

No direct malicious payload behaviors (exfiltration, backdoors, credential theft, or obfuscation) are evident in the provided fragment. However, the `--install` mode creates a significant supply-chain/operational execution risk by running `npx` to install missing companion skills, and `--out` can drive filesystem writes to a caller-influenced path if validation is incomplete. This should be treated primarily as an installer automation with elevated review requirements rather than inherently malicious code.