bird-fast

SUSPICIOUS: The skill’s capabilities match its stated Twitter automation purpose, but it depends on a third-party CLI that harvests browser-session cookies or accepts raw auth tokens, then uses private X endpoints and can post publicly on the user’s behalf. Install paths are not overtly malicious and are same-owner, yet the personal-publisher distribution, weakened release verifiability, and credential forwarding make the footprint higher-risk than a normal API wrapper.