instagram

SUSPICIOUS. The skill’s Instagram read/write capabilities broadly match its stated purpose, but it centralizes sensitive social-account access and publishing through a non-official third-party CLI from a personal publisher, with transitive skill-install patterns and meaningful real-world action capability. Data flows are purpose-consistent, yet the install/trust model and credential handling are stronger risks than a normal vendor-owned integration.