wx-channels-download

SUSPICIOUS. The skill's stated purpose matches its basic behavior, but its core data flow depends on a non-official third-party parser on workers.dev, and users can redirect parsing to arbitrary endpoints. It does not show credential theft or overt malware behavior, but the intermediary network design and cross-project trust relationship make it medium risk.