reply-maker

SUSPICIOUS. The skill’s purpose and main API flow are coherent: drafting X replies from xAI search or local logs is consistent with its stated function, and the primary network endpoint is xAI’s official API. However, Mode A passes `XAI_API_KEY` through an unverifiable local helper `./secretcurl`, which materially raises supply-chain and credential-forwarding risk. Local scripts `./notify` and routing hooks are also unverified, and the fallback WebSearch destination is unspecified. This is not confirmed malware, but it is higher-risk than a purely local drafting skill because a black-box local executable handles credentials and outbound API traffic.