social-har-api-connectivity

The code is not obviously obfuscated and does not contain direct malicious actions like remote C2 or system command execution beyond launching Chrome. However, it explicitly harvests authentication/session material (cookies, sensitive headers, and token-like strings) from browser network traffic captured via CDP, then writes it to auth.json and prints extracted token snippets to stdout. This creates a high misuse potential consistent with credential theft/session hijacking tooling. Overall, treat as security-critical and review/limit where and how it is used; if present in a dependency, it is a strong red flag despite lacking classic malware indicators.

SUSPICIOUS. The skill's footprint is coherent with its stated goal, but the goal itself is high-risk: it captures browser session tokens via Chrome debugging, stores them locally, and reuses them for autonomous account actions. The undocumented capture script further weakens trust. This is not confirmed malware, but it is a high-risk credential interception and account-action skill.