last30days

SUSPICIOUS: the skill’s purpose and requested credentials are mostly coherent, and data flows point to official OpenAI/xAI services rather than obvious exfiltration endpoints. However, its core behavior depends on an unreviewed local script and it processes untrusted external content at scale, creating medium security risk despite no strong evidence of malware.