social-inbox-agent

SUSPICIOUS. The skill is purpose-aligned and uses official-looking Late and Gemini endpoints with proportionate credentials, so it does not look like credential-harvesting malware. However, it enables autonomous outbound social messaging based on untrusted inbound content, which creates meaningful abuse and safety risk even without supply-chain or exfiltration red flags.