xactions-cli

SUSPICIOUS. The skill's scraping and MCP-config capabilities broadly match its stated purpose, and the install path is a verifiable npm/docs flow rather than a raw payload. The main concern is scope and trust: it requires the user to manually extract and hand a live X session cookie to a third-party CLI, which is a high-risk credential-forwarding pattern even though it appears purpose-related. No confirmed malicious exfiltration, hidden execution, or rogue endpoint routing is evident from the supplied material.