marketing-pipeline-ai-content-automation

SUSPICIOUS. The skill’s capabilities mostly match its stated marketing-automation purpose, and the scanner hits are documentation artifacts. The main concern is install trust: the skill is published by ara.so but tells users to clone and run code from an unrelated personal GitHub repo, then provide multiple high-value API and cloud credentials. No explicit credential theft or malicious exfiltration is shown, so this is not malware, but the trust chain and broad credential scope make it medium risk.