astock-social-feed

SUSPICIOUS. The skill’s purpose and capabilities are broadly aligned, and it avoids package installs or hidden execution. The main concern is data-flow integrity: it routes all market-social queries and the API token through an unverified third-party domain rather than official platform APIs, creating medium trust and credential-handling risk. This is not confirmed malware, but it is not fully benign.