publish-social

SUSPICIOUS. The stated purpose matches social publishing, and the named Typefully/CSV workflows are plausible, but the skill handles raw local credentials and enables live posting across 9 platforms while relying on an unnamed browser-automation layer. No confirmed malware or explicit exfiltration is visible, yet the combination of credential auto-detection, public-action capability, and unverifiable automation makes this medium risk.