marketing-pipeline-ai-content

SUSPICIOUS. The skill’s capabilities largely match its stated marketing-automation purpose, and credential use for Anthropic/OpenAI/RapidAPI is proportionate. The main concern is install trust: ara.so publishes the skill, but users are told to clone and run code from an unrelated personal GitHub repo with mutable dependencies and no same-org verification. No clear malware or credential-stealing behavior is shown in the skill text, but the publisher/source mismatch and third-party aggregation via RapidAPI make the trust chain weaker than a benign official skill.