pp-xai

SUSPICIOUS: the skill's xAI-wrapper purpose is plausible, but its footprint relies on externally installed binaries from a different apparent publisher, forwards credentials through that CLI, supports arbitrary webhook output delivery, and encourages MCP side-installation. These are proportionate to a power-user API CLI, but the provenance mismatch and transitive trust make the skill medium risk rather than benign.