twitter-scraping

SUSPICIOUS: the skill’s scraping capabilities match its stated purpose, and install/data flows mostly stay within npm + x.com, but it asks for a raw X session cookie and encourages paste-executing code in an authenticated browser. That creates meaningful credential/session and privacy risk without clear evidence of overt exfiltration or malware.