soia-pkm-clip-x

SUSPICIOUS: The core behavior mostly matches the stated purpose of archiving X content into Obsidian, and the config/credential references are proportionate. The main concerns are transitive skill installation, wildcard access in the npx example, and reliance on a third-party X mirror API rather than an official API; these raise trust and supply-chain risk but do not show clear malware or credential theft.