stacktree-publish

SUSPICIOUS: the overall purpose is coherent for a report-publishing skill, and the Stacktree domains appear official, but the skill routes content and credentials through an unseen local shell helper instead of the documented direct API/MCP path. Main risk is external publication of potentially sensitive report data plus opaque helper-script behavior, not clear malware.