wrench

SUSPICIOUS. The stated purpose matches web automation and provider integration, but the trust model is disproportionate: a non-verifiable `wrench` CLI is entrusted with cookies, OAuth credentials, inbox/message data, and publishing actions, and it can install/execute unsandboxed plugins. The main risk is credential forwarding and opaque code execution rather than confirmed malware.