canghe-danger-x-to-markdown

SUSPICIOUS. The skill’s main behavior matches its stated purpose, but it relies on a reverse-engineered X access method, raw session credentials/cookies, and unpinned runtime execution. No clear credential theft or covert exfiltration is shown in the provided text, so this is not confirmed malware, but the authentication and supply-chain footprint are broader and less trustworthy than a normal official API integration.

This module is highly sensitive because it automates Chrome CDP to navigate to an X/Twitter login URL and extract authentication cookies (auth_token/ct0/gt/twid), optionally saving them to disk and generating Cookie headers for subsequent requests. While the behavior can be legitimate for account automation, it matches a common credential/session harvesting pattern. There is no direct evidence in this snippet of obfuscation, reverse shells, or network exfiltration to suspicious domains, but the handling of real session tokens introduces significant security risk if the surrounding project or endpoints are not strictly controlled.

This module is configuration-like, but it embeds and exports a hardcoded bearer token and exposes Chrome-profile-path derivation and cookie-name configuration that strongly suggest downstream automated authenticated access to X. While the fragment itself contains no explicit malicious execution or exfiltration logic, the presence of embedded credential material and local session/credential-handling indicators make the supply-chain security risk high and warrant immediate review of downstream usage, token legitimacy/rotation, and any local cookie-reading behavior.