competitive-intel

SUSPICIOUS: The skill’s purpose and official Xpoz endpoints broadly align, and the SDK/MCP install paths appear same-org and documented. The main concerns are credential handling and context leakage: it asks users to paste API keys/OAuth codes into chat and posts descriptive task metadata to Xpoz for trial tokens. This is not fundamentally incompatible with the stated purpose, but it is a medium-risk integration pattern rather than a cleanly scoped low-risk skill.