scrapesocial-x

SUSPICIOUS: the stated read-only X research purpose is coherent, but the install and trust chain are not. The skill directs users to obtain an official vendor API key, then gives that key to a different CLI/package than the vendor's documented official one. This mismatch makes the package effectively an unverifiable third-party credential receiver, creating a high supply-chain and credential-harvesting risk even without direct evidence of malware.