upload-post

SUSPICIOUS. The skill is mostly coherent with its stated purpose and uses same-brand documented API endpoints without risky local installs, so it does not look overtly malicious. Risk comes from autonomous public-posting capability, third-party aggregation of social account actions, and remote FFmpeg command processing; the service should only be used with explicit user approval per action.