soia-pkm-publish-wechat-draft

SUSPICIOUS. The skill’s purpose, WeChat credentials, and direct draft-creation flow are largely coherent and there is no clear sign of credential theft or off-platform exfiltration. However, the documented installation uses transitive skill loading through a third-party CLI and requests wildcard agent permissions, which is broader than necessary for this publishing task and raises medium security risk.