social-media-kit

SUSPICIOUS: the skill is purpose-aligned and does not show credential theft or obvious exfiltration, but it grants an AI agent the ability to take real-world public posting actions across multiple platforms using the user's logged-in browser. Install trust is mostly acceptable; the main risk is autonomous posting/edit/delete capability, not malware.