here-now

SUSPICIOUS. Core publishing behavior, credential use, and API calls are broadly consistent with a static-hosting skill and mostly target official here.now infrastructure, so this is not confirmed malware. Risk is elevated by transitive skill installation, local credential storage, optional non-default base URL support, and especially the payment-gating/financial workflow with silent polling, which expands the skill beyond basic file publishing.