setup-browser-cookies

SUSPICIOUS. The core cookie-import capability is legitimate and aligned to the stated purpose, and the Bun fallback is from an official source with checksum verification. The main concern is that this narrow skill inherits a much broader gstack operational footprint: local helper binaries, telemetry/artifact-sync logic, repo inspection, and possible project-file modification unrelated to cookie setup. I do not see confirmed malicious exfiltration in the provided content, but the scope is disproportionate enough to warrant caution.