social-poster-hardened

SUSPICIOUS: the skill’s purpose matches social posting, but its trust model does not. The main issue is credential and content routing through an unverified Replit-hosted API with a hardcoded key, plus an unpinned `npx` install path. This is not confirmed malware, but it presents high security risk and disproportionate trust requirements for a posting skill.