hootsuite-debug-bundle

SUSPICIOUS. The skill’s network targets and credentials are aligned with Hootsuite troubleshooting, and there is no malicious installer or third-party credential forwarding. But the actual collection script is inconsistent with the skill’s own redaction rules: it saves raw profile and scheduled-post API payloads locally, likely including account metadata and possibly content fields that the instructions explicitly prohibit. This is a data-minimization and support-bundle scoping problem, not confirmed malware.