soia-meta-publish-market

SUSPICIOUS. The core packaging purpose is coherent, but the skill expands trust by installing additional skills/plugins, using a curl|bash installer, and directing users to a CDN-hosted uploader that may receive marketplace credentials and package contents. Final submission is customer-gated, which lowers maliciousness, but the supply-chain and credential-forwarding footprint is higher than ideal for a packaging skill.