xray-cli

SUSPICIOUS. The skill's purpose, API scopes, and official Xray/Jira data flows are largely coherent for test-management automation, and most scanner hits are documentation false positives. However, the actual `bun xray` executable is not independently verifiable from the provided evidence and is entrusted with multiple credentials plus broad remote write capability; that credential-forwarding trust gap makes the skill high risk despite otherwise aligned functionality.