upwork-application-session

SUSPICIOUS: the skill's purpose aligns with its capabilities, but it automates real Upwork proposal submissions through the user's authenticated Chrome profile, which is a high-risk autonomous action. No clear evidence of malware or third-party credential harvesting appears in the visible instructions, but the combination of browser-session reuse, local script execution, and public posting makes the skill materially risky.