x-comment-analyzer

SUSPICIOUS: The skill’s core behavior matches its stated purpose, but its trust boundary is a third-party aggregator rather than official X/Twitter APIs, and it encourages agent-assisted handling of a raw API key. No clear malware or covert exfiltration is shown, but the credential routing and unverifiable external data service make it medium risk.