court-dockets

SUSPICIOUS. The stated purpose mostly matches docket-retrieval behavior, but the skill includes a load-time pre-execution directive that runs an unverifiable local plugin binary before normal review. Cookie-based access to legal platforms is proportionate to the task, yet the pre-exec trust boundary and missing provenance for plugin-utils push overall risk high even without clear evidence of malware or exfiltration in the visible text.

No executable malware or explicit data exfiltration is shown. The documentation does describe obtaining and reusing live browser authentication cookies, including HttpOnly cookies, and conducting bulk downloads from subscription services. This presents an authorization and session-security concern if used beyond an authorized account and permitted purpose.

This module is specifically designed to extract HTTP cookies (session/authentication material) from a locally running Chrome/Chromium instance exposed via the DevTools Protocol. It discovers a debuggable page on localhost, connects to its CDP WebSocket, calls Network.getCookies for a chosen URL, and returns/partially prints the resulting cookie data. In a malicious or unintended context, this pattern enables session hijacking/credential theft; the code contains no safeguards or consent checks and directly handles sensitive cookie values.