grok-bot

SUSPICIOUS: the skill’s capabilities broadly match its purpose, but it is an unofficial personal-repo wrapper that accesses local session secrets from Keychain/sand-secrets.json and forwards them through a local CLI to a remote service. The main concerns are install trust, transitive skill installation, and third-party handling of authentication material rather than clear evidence of malware.