pp-x-twitter

SUSPICIOUS. The skill is mostly purpose-aligned for an X/Twitter CLI, and the installer appears same-publisher rather than an unrelated third-party payload. However, it asks the agent to install and trust an external binary with unpinned latest-based installs, and it enables many high-impact authenticated actions plus optional webhook delivery of outputs. This is not confirmed malware, but it is a medium-risk skill that should be used only with strong user approval for installs and any write/posting actions.