x2c-publish

SUSPICIOUS. The skill’s core publishing behavior is broadly aligned with its purpose, but it expands into wallet/withdrawal actions with real-world consequences, stores raw API keys locally, and has inconsistent credential-source instructions. The biggest issue is data-flow/provenance ambiguity: credentials and actions are sent to a Supabase-hosted gateway instead of an obviously official X2C API domain, so trust depends on unverifiable documentation consistency rather than clear first-party routing.