wildix-chats-overview

SUSPICIOUS: The core purpose, credentials, and data flow to official x-bees endpoints are broadly consistent with a chat-overview skill, so this is not clearly malicious. The main concern is transitive installation of peer skills from an unverified `Wildix/agent-skills` repo via `npx skills add`, which adds medium supply-chain and trust risk.

This module primarily performs authenticated retrieval of chat/channel data from expected external APIs and formats it into JSON for downstream use. No clear indicators of intentional malware are present in the fragment. However, it embeds a hardcoded API key and handles sensitive authorization material by writing tokens/payloads to cleartext temporary files and passing a token via command-line arguments, both of which increase supply-chain and operational security risk. Treat this as a data-access utility with meaningful secret/privacy hygiene issues rather than a malicious payload.

No direct malicious behavior is evidenced in this snippet because it contains only configuration and install directives. The primary concern is elevated supply-chain and audit risk: it dynamically installs a remote package via `npx` with silent/auto-confirm flags and without visible version pinning/integrity verification, then relies on local `SKILL.md` to define sensitive authentication and data-fetching behavior. To assess malware/exfiltration risk, the contents of the referenced `SKILL.md` files and the installed `Wildix/agent-skills` code (including any install/postinstall scripts) must be reviewed.