algorithm-cultivation

SUSPICIOUS. The skill’s capabilities match its stated purpose, but that purpose is itself high-risk: it enables autonomous public posting and engagement, asks for live X session credentials, and runs code either via DevTools paste or a third-party CLI. Install provenance is better than a random binary because xactions appears to be a real npm-published project, but credential forwarding and continuous account automation remain disproportionate and risky.

The supplied text documents an automated, stealthy social-media growth and influence bot, not ordinary application functionality. It contains no direct evidence of traditional malware because no executable code is present, but the described behavior is intentionally designed to evade detection and generate inauthentic engagement. Review of the referenced JavaScript files, browser authentication handling, prompts, API requests, and persistence code is required for a complete supply-chain assessment.