9router-video

SUSPICIOUS. The skill’s stated purpose is coherent, and its CLI/install path looks same-org and largely verifiable, so this is not confirmed malware. However, the core data flow is through a third-party proxy (9Router) instead of direct xAI API calls, meaning prompts, auth context, job IDs, and result metadata pass through an intermediary service. That makes the skill materially higher risk than a direct xAI integration.