soul-builder

SUSPICIOUS. The skill’s purpose, data collection, and official xAI API flow are broadly coherent, and there is no confirmed exfiltration or malicious pre-execution behavior. The main concern is execution trust: it relies on opaque local binaries/scripts (especially ./secretcurl, which handles XAI_API_KEY) and an unverified x-mcp fallback, so the skill’s real credential and network behavior cannot be fully reviewed from the skill text alone.