baoyu-danger-x-to-markdown

SUSPICIOUS: The skill’s core function is coherent, but it relies on a reverse-engineered API and raw X session credentials/cookies, and the actual script code is missing, so credential/data routing cannot be verified. Runtime execution via `npx -y bun` is from an official ecosystem and not by itself malicious, but the overall trust model is weaker than an official API-based converter.

This module is highly sensitive because it automates Chrome CDP to navigate to an X/Twitter login URL and extract authentication cookies (auth_token/ct0/gt/twid), optionally saving them to disk and generating Cookie headers for subsequent requests. While the behavior can be legitimate for account automation, it matches a common credential/session harvesting pattern. There is no direct evidence in this snippet of obfuscation, reverse shells, or network exfiltration to suspicious domains, but the handling of real session tokens introduces significant security risk if the surrounding project or endpoints are not strictly controlled.

This module is configuration-like, but it embeds and exports a hardcoded bearer token and exposes Chrome-profile-path derivation and cookie-name configuration that strongly suggest downstream automated authenticated access to X. While the fragment itself contains no explicit malicious execution or exfiltration logic, the presence of embedded credential material and local session/credential-handling indicators make the supply-chain security risk high and warrant immediate review of downstream usage, token legitimacy/rotation, and any local cookie-reading behavior.