wjs-syndicating-articles

SUSPICIOUS. The visible instructions are mostly coherent for a social-syndication skill and do not show overt malware or installer abuse, but the core posting logic and credential routing are hidden in missing scripts. Because the skill can autonomously publish content on a schedule and handle platform credentials without verifiable endpoint details, it carries medium security risk despite purpose alignment.

The fragment is a readable automation wrapper, not evident malware. It delegates substantial filesystem, command-execution, and publication authority to the Claude CLI and an external skill during an unattended scheduled run. This creates a meaningful supply-chain and automation risk if the project, skill, Claude configuration, or proxy is compromised, but the provided script contains no direct credential theft, obfuscation, reverse shell, destructive behavior, or explicit data exfiltration.