view-tweet

SUSPICIOUS. The core purpose is coherent: reading X posts via Grok fits the stated goal. Main risks come from requiring unsandboxed external CLI execution, dependence on Grok auth/session files, and a fallback that sends tweet lookups to the unrelated third-party FxTwitter API instead of official X/xAI endpoints. The Grok dependency appears same-org and officially documented, so this is not confirmed malware, but the trust and data-flow footprint is broader than a minimal tweet-viewing skill.