threads-hook-extractor

SUSPICIOUS. The skill’s purpose is coherent and mostly well-scoped, but it has a notable trust-boundary issue: official Apify transport is used to run a third-party scraping actor, creating medium supply-chain and credential-forwarding risk without pinning or stronger provenance controls. No direct malware, exfiltration, or hidden execution is evident.