creator-shortlist

SUSPICIOUS: The skill’s stated purpose mostly matches its behavior and it stays read-only, but it relies on a transitive `unifapi` skill and routes all external platform data through UnifAPI’s gateway/MCP rather than official platform APIs. That brokered data flow is a moderate trust and privacy concern, though there is no evidence here of credential harvesting, command execution, outreach automation, or overt exfiltration.