x-twitter-scraper

SUSPICIOUS: the skill’s main API behavior is broadly aligned with its stated X/Twitter integration purpose and uses same-org endpoints, but its footprint is somewhat understated. The biggest concern is data-flow integrity around MCP: the skill claims first-party-only dependencies while the official setup evidence may route the Xquik API key through third-party npm package mcp-remote. Combined with broad write/billing/monitoring capabilities, this makes the skill medium risk rather than clearly benign.