comment-funnel

SUSPICIOUS. The skill is largely purpose-aligned and uses same-org Upload-Post docs/API endpoints, with no installer or obvious malware signals. Risk is driven by third-party credential forwarding, unverified persistent monitor endpoints, and autonomous outbound DM actions on the user's behalf.