x-to-obsidian

SUSPICIOUS: the archival purpose is coherent, and most permissions are proportionate, but the main X retrieval path routes data through an unofficial third-party proxy (FxTwitter) instead of X's official API. Optional Telegram MTProto sync also requires sensitive credentials handled by third-party library code. No confirmed malware or overt exfiltration behavior is present, but install/data-flow trust is only partially sound.