last30days

This module primarily performs configuration loading but includes high-sensitivity capabilities: it retrieves secrets from macOS Keychain (`security find-generic-password`), the `pass` password store (`pass show`), and optionally extracts browser cookies to populate authentication tokens (`AUTH_TOKEN`, `CT0`, etc.). That combination is consistent with credential-harvesting risk. In this fragment there is no direct evidence of external exfiltration or code execution, but the presence of these secret-access workflows warrants careful review of surrounding code (especially any network transmission of the collected credentials).

Moderate supply-chain and secret-handling risk. The code optionally reads browser cookies, writes API keys and setup flags to local files, and runs npx/brew commands to install third-party CLIs at runtime. It also performs a remote device authorization flow to retrieve an API key from api.scrapecreators.com and may open a remote-provided verification URI and copy codes to the clipboard on macOS. No direct evidence of overt malware/backdoor is present in this fragment, but the combination of runtime installs plus sensitive credential/cookie handling warrants scrutiny.

No clear malicious payload or intentional data-theft behavior is present in the shown code. It is a search-provider integration with credential staging and external process execution. The use of an unverified PATH-resolved binary together with --permission-mode bypassPermissions creates a meaningful supply-chain and credential-exposure risk if the Grok CLI is compromised or replaced. The fragment also contains apparent syntax and logic defects. Review the CLI trust model, avoid bypassPermissions where possible, verify executable provenance, and minimize credential exposure.

SUSPICIOUS. The skill’s core purpose and capabilities mostly align, and its stated endpoints are largely coherent with a multi-source research tool. However, its footprint is unusually large for a skill: optional browser-cookie extraction, many third-party/API integrations, config-file handling, external publishing, and risky installer patterns create meaningful security exposure. The x.ai curl|bash path appears official rather than deceptive, so this is not confirmed malware, but the overall setup and credential scope are broader than minimally necessary and should be treated as medium-high risk.

This module is a local browser cookie extractor. It searches for Firefox (including WSL access to Windows profiles), copies cookies.sqlite to a temp file, queries moz_cookies for a specified domain and cookie names, and returns the cookie values to the caller—behavior strongly aligned with session/cookie theft. It further orchestrates extraction for other browsers on macOS via helper modules. No clear protective measures or legitimate-use safeguards are present in this fragment.

This module is a CDP-based browser cookie harvester that extracts and returns a targeted authentication cookie pair (auth_token and ct0) associated with x.com/twitter.com from a live Chrome/Chromium session. The mechanism (Network.getAllCookies) and the specific cookie targeting strongly align with credential/session theft rather than benign functionality. Risk is elevated further by the ability to override the CDP endpoint via BROWSER_CDP_URL and by the custom low-level WebSocket implementation. The only meaningful uncertainty is whether this code is used in a consented/authorized context, and the fragment appears truncated/typoed at the end, but the sensitive behavior is fully observable in the provided logic.

This module contains a highly suspicious, targeted capability to harvest and decrypt Chromium-family browser cookies on macOS. It enumerates and copies browser cookie SQLite databases, obtains the necessary decryption passphrase from the macOS Keychain via `security`, decrypts v10 encrypted cookie values using OpenSSL, and returns plaintext cookie/session material for caller-selected domains and cookie names. Even without visible exfiltration in this snippet, the implemented behavior aligns strongly with cookie/session theft tooling and presents a critical privacy/security risk if included in a software supply chain.

This module is a high-sensitivity credential-handling component: it specifically reads Twitter/X session cookies (auth_token and ct0) from environment variables or from local browser cookie stores (via a third-party helper) and then constructs and returns an HTTP Cookie header containing those secrets. While it shows no direct exfiltration or malicious payload execution within this snippet, the capability to harvest authentication material is inherently dangerous if misused or if the dependency/downstream request handling is compromised. The dynamic import of @steipete/sweet-cookie adds supply-chain execution risk. Review downstream usage of the returned cookieHeader and ensure strict protection of logs, telemetry, and network destinations.

This module is an orchestrator that conditionally launches a dedicated “box-chrome” browser instance pointed at a login page, with remote debugging enabled and a persistent profile directory under /tmp so that other components can harvest browser cookies during a subsequent setup step. In this file alone there is no clear evidence of covert exfiltration, backdoors, or direct credential theft beyond facilitating a sensitive cookie/login workflow. The main risks are (a) execution of an externally discovered binary (PATH influence), (b) import-resolution via sys.path modification (local lib integrity/supply-chain risk), and (c) handling of browser session artifacts due to the fixed /tmp profile and remote debugging wiring. Review the surrounding project code that performs cookie harvesting ('setup --allow-browser-cookies') and ensure the harvested data is protected and authorized.

This module is a macOS-specific parser that reads Safari’s local Cookies.binarycookies file and extracts selected cookie values for a provided domain and cookie name set. It contains no direct network exfiltration, command execution, or obfuscation in this fragment. The security risk is primarily its capability to harvest highly sensitive authentication/session cookies, which could be misused by other parts of a containing package. Additionally, the snippet shows a likely defect (`return resul`), which may impair execution but does not negate the sensitive extraction design.

No clear malware behaviors are evident in this fragment (no eval/dynamic execution, no local persistence, and no explicit data exfiltration beyond normal HTTP requests). However, there is a significant security anomaly: getBaseHeaders() hardcodes an Authorization Bearer token in addition to accepting/storing user-provided auth cookies and CSRF token, which materially increases credential exposure and supply-chain risk. The module also suppresses errors during query-id refresh, which can reduce operational transparency. Because the snippet is incomplete beyond ensureClientUserId(), full determination of destinations and how responses are handled is not possible here.