cookie-security-analyzer

SUSPICIOUS: The skill is not overtly malicious and shows no credential theft or exfiltration path, but its broad Bash(npm:*) permission is disproportionate to a largely documentation-style cookie security helper. The main concern is execution scope and unpinned npm-based supply-chain exposure, not confirmed malware.