grok-voice

SUSPICIOUS: the skill's core purpose is coherent, but its data flow is through Pixazo rather than xAI's official API, so credentials and content are entrusted to a third-party gateway. It also instructs raw API key storage in a local file and includes an unnecessary wildcard transitive skill installation command. Not confirmed malware, but medium security risk due to intermediary credential routing and broadened trust scope.