fetch-tweets

Overall purpose and network destination are coherent: this is a tweet-digest skill that queries the official xAI API and X content, then logs and notifies. The main security issue is not the stated functionality but the undocumented local helper executables—especially `./secretcurl`, which sits in the credential path as a black box. That makes the skill suspicious/high-risk rather than confirmed malware.