social-media-publishing

SUSPICIOUS. The skill’s capabilities largely match its stated social publishing purpose, but it grants an AI agent the ability to perform public posting and commenting on the user’s behalf across multiple platforms, which is high-impact autonomy by design. Data flows are mostly consistent with official APIs, though the Modal-backed YouTube path introduces a third-party intermediary that is broader than a direct platform integration. This looks like a high-risk but purpose-consistent publishing skill, not confirmed malware.

This CLI entrypoint itself does not show overt malware behavior (no explicit exfiltration, shell execution, or credential theft in the fragment). However, it meaningfully increases security exposure through (1) dynamic execution of local module code via exec_module, (2) runtime sys.path manipulation that can alter import precedence, and (3) arbitrary user-supplied URL downloading with redirects and direct disk writes of remote bytes. It then seeds credentials from a user-supplied env-file path and delegates the sensitive upload/polling/encoding behavior to imported workflow modules not included here, so the overall supply-chain/security posture depends heavily on those modules’ safety (network destinations, subprocess invocation, and credential handling).