social-listening

SUSPICIOUS. The stated purpose is coherent with the read-only social-listening actions, but the trust model is weak: the skill depends on a third-party MCP endpoint and a transitive plugin install from a lightly established GitHub repo. Capabilities are mostly proportionate, yet the external mediation, shell access, and install chain raise medium-high security risk without clear evidence of outright malware.