social-publisher

SUSPICIOUS. The skill is internally coherent for social publishing and uses matching official docs/endpoints, so it does not look malicious. However, it gives an AI agent the power to make autonomous public posts and forwards a workspace API key into a third-party CLI/service, creating meaningful operational and credential trust risk.