zhihu-publisher

SUSPICIOUS. The skill’s overall behavior mostly matches its stated Zhihu publishing purpose, and its main credential/data flow appears intended for Zhihu rather than a third-party proxy. However, it reads raw local credentials, can perform public posting, and relies on a separate uploader skill whose provenance and install path are not verifiable from the provided evidence, creating medium security risk through transitive trust.