social-har-api-connectivity

SUSPICIOUS. The skill's actual function is browser-session interception: it captures full login traffic, extracts reusable cookies/tokens, stores them, and uses them to post/read on behalf of the user. That is disproportionate to a normal API connectivity skill, bypasses official auth patterns, and relies on an unspecified capture script to handle credential material. High risk even without a named external exfiltration server.

The code is not obviously obfuscated and does not contain direct malicious actions like remote C2 or system command execution beyond launching Chrome. However, it explicitly harvests authentication/session material (cookies, sensitive headers, and token-like strings) from browser network traffic captured via CDP, then writes it to auth.json and prints extracted token snippets to stdout. This creates a high misuse potential consistent with credential theft/session hijacking tooling. Overall, treat as security-critical and review/limit where and how it is used; if present in a dependency, it is a strong red flag despite lacking classic malware indicators.