goofish-publish-item

SUSPICIOUS: the skill’s core behavior matches its stated purpose, but it relies on a non-vendor personal CLI/MCP ecosystem, forwards sensitive marketplace session material through that toolchain, and references an undeclared companion skill. The public-posting action is constrained by explicit confirmation, so this is not confirmed malware, but it carries meaningful trust and credential-handling risk.