wjs-tweeting-from-articles

SUSPICIOUS: the core purpose and X API data flow are mostly coherent, and xurl appears to be an official same-purpose dependency, but the skill enables autonomous public posting and persistent cron-based automation. Risk is elevated by undisclosed local script contents and real-world posting capability rather than clear credential theft or malicious exfiltration.