ui-json-capture

SUSPICIOUS: the stated purpose matches the browser-capture behavior, but the skill materially increases risk by auto-executing a local `skill-toc` helper at load time and by enabling bulk extraction from authenticated paid services. No clear credential exfiltration is shown, but the pre-exec local binary trust chain and transitive tool reliance make the skill high-risk overall.

This module is behaviorally suspicious: it globally monkey-patches XMLHttpRequest to target a specific endpoint path and collects full JSON result rows into a persistent in-memory global (window.__cap) with deduplication and error logging. No direct network exfiltration or payload execution is present in the provided fragment, but the design aligns with client-side scraping/data harvesting and could enable unauthorized data collection if used in an untrusted context.