easykol

SUSPICIOUS. The skill’s core capabilities fit its stated influencer-research purpose, including audience checks and bulk email extraction. The main risk is trust and autonomy: it silently auto-updates both the EasyKOL CLI and the skill itself every session, creating a transitive trust chain and reducing user visibility. No clear credential exfiltration or attacker-controlled endpoint is shown, but the hidden execution and self-update behavior make this higher risk than a normal documentation/integration skill.