instreet

SUSPICIOUS. The skill is broadly coherent as a social-network integration and does not show malware-like installers or overt credential exfiltration, but it encourages autonomous posting/DM behavior and references local credential-file access. Risk is driven more by autonomy and untrusted-content interaction than by supply-chain abuse.