agent-message-cli

SUSPICIOUS: The skill’s capabilities mostly match its messaging purpose, but trust is weakened because the exact npm package/publisher is unverified and all message/auth traffic can be redirected to arbitrary servers via server_url. This is not confirmed malware, but it carries medium risk due to external message-sending capability, local token storage, and configurable data flows.