social-publisher

No explicit malware behavior (e.g., exfiltration, backdoor communication, credential harvesting) is evident within this module. The dominant security concerns are (1) arbitrary code execution risk via `source` of a workspace env file when present (and via sourcing json_store.sh), and (2) potential path traversal/overwrite through `template_save` where template name is unsanitized and used to form an output path. Scheduling also uses regex-based JSON rewriting, which is an integrity risk. Because this script delegates operational publishing/rendering to post.sh/render.sh, a complete risk assessment depends on those downstream scripts’ handling of inputs and side effects.

SUSPICIOUS. The stated purpose broadly matches rendering, queue management, posting, and analytics, but the skill withholds key trust details: required credentials, actual network endpoints, and exact install provenance for dependencies. Because it enables autonomous public posting and likely forwards credentials/content to unspecified services via repo-local shell scripts, its footprint is not transparent enough to classify as benign from this excerpt alone.