wribble

SUSPICIOUS. The skill’s capabilities fit a blog publishing tool, but the install target, product identity, and auth domain could not be verified, so users would be sending a publishing token and content to an unclear third-party service through an unverified CLI. The main issue is trust and provenance, not confirmed malware.