xactions-mcp-server

SUSPICIOUS. The skill's capabilities broadly match its claimed purpose, and the install path appears to be official npm/docs rather than a deceptive downloader. However, it requires a raw X session cookie, grants an external MCP package the ability to act as the user on X, supports autonomous public posting and messaging, and can process/export sensitive account data; these are high-impact but purpose-consistent risks rather than confirmed malware.