marketing-launch

SUSPICIOUS: the skill’s purpose is coherent, and the external install evidence is consistent with official tooling rather than a deceptive payload. However, it combines browser automation, untrusted-web research, local file writes, and possible codebase modification, creating meaningful indirect prompt-injection and action risk for an AI agent even without clear malicious intent.