sherlock

SUSPICIOUS: the skill is internally consistent and uses official install sources, with no credential harvesting or hidden exfiltration, so it is not malware-like. However, its stated purpose is active OSINT/reconnaissance against many social platforms, which is a high-misuse security capability for an AI agent and warrants elevated risk despite otherwise coherent design.