soia-pkm-clip-x

SUSPICIOUS: the skill’s main purpose is coherent, but its footprint has notable trust concerns. The largest issues are third-party proxy retrieval via fxtwitter, transitive installation through a skills CLI from GitHub, and a wildcard-permission install command. Optional Telegram credential use is proportionate only when that sync feature is explicitly used. No confirmed malware or overt credential theft is present, but the install/data-flow model is riskier than a narrowly scoped local-only archiver.