last30days

SUSPICIOUS. The skill's core research purpose is legitimate, but its footprint is broad: many optional credentials, persistent config writes, third-party API routing, and high-volume untrusted content processing combined with Bash/Write permissions. This looks more like an overpowered research orchestrator than a narrowly scoped skill, so the main concern is security exposure and disproportionate scope rather than confirmed malware.

This module is not overtly malware by itself (no execution of untrusted code beyond a normal dependency import, and no direct exfiltration/network calls are present). However, it performs high-sensitivity credential extraction by targeting x.com auth cookies (auth_token and ct0) from env/CLI and optionally from local browser profiles, then returns a reusable Cookie header to the caller. The main security concerns are (1) credential-handling risk due to returning session secrets and (2) supply-chain trust in the dynamically imported cookie-access dependency.