x-undocumented-api

SUSPICIOUS: the skill is internally coherent, but its purpose is to operationalize X's undocumented private web API using raw browser session credentials and dynamic bundle extraction rather than official developer interfaces. Data stays on X-owned domains and there is no obvious third-party credential theft or malicious installer, but the scope and auth model are disproportionate for a normal developer-tool skill and enable risky live-account actions.