security-osint

SUSPICIOUS. The core capability fits the stated OSINT purpose and the Xpoz domains/SDKs appear same-org and official, so this is not fundamentally malicious. However, the skill routes user secrets through chat, sends contextual metadata to a trial-token endpoint, and contains an auth-path inconsistency for Claude Code; these make the skill moderately risky and less trustworthy than a clean direct-OAuth integration.