marketing-demo

SUSPICIOUS: The skill’s purpose and capabilities mostly align, and there is no clear credential theft or exfiltration behavior. The main issue is install/execution trust: unpinned `npx` use plus an unverifiable `ply` dependency create disproportionate supply-chain risk for an otherwise benign marketing workflow.