soia-pkm-clip-x

SUSPICIOUS: the skill’s main archive-to-Obsidian behavior is coherent, but it relies on an unofficial X content proxy and instructs transitive skill installation with broad permissions. Optional Telegram credential handling is relevant but expands scope; overall this looks more like a risky but plausibly legitimate workflow skill than confirmed malware.