geoflow-content-automation

SUSPICIOUS. The skill’s capabilities mostly match its stated GEO/SEO automation purpose, and data flows are largely coherent, but trust signals are weaker than ideal: ara.so branding is not clearly tied to the personal GitHub publisher, install uses an unpinned source checkout, and the system can forward API keys/content to arbitrary OpenAI-compatible endpoints and auto-publish content. This looks more like a legitimate but moderately risky operations/deployment skill than malware.