x-twitter-publish

SUSPICIOUS: The skill’s purpose matches social publishing, but its actual footprint relies on a third-party intermediary for both X credentials and account actions. No obvious malware or installer abuse is present, yet the credential relay, optional TOTP handling, inbox/DM scope, and autonomous public-action capability make this a high-trust integration with significant security risk.