ads-publish

SUSPICIOUS. The stated purpose matches social publishing, and the external service appears to be a real vendor with official docs and registry-published SDKs. However, this skill delegates the critical behavior to an unprovided local script, so the actual data flows, endpoint integrity, and confirmation safeguards cannot be verified. Because it uses a third-party publishing gateway with impactful real-world posting actions and forwards a high-privilege API key, the risk is medium even though there is no clear evidence of malware.