analyze-x-subscriptions

This module functions as a code generator for an authenticated, browser-based scraper targeting x.com internal GraphQL endpoints. It embeds a hardcoded bearer token, extracts a CSRF token from cookies, dynamically derives internal query IDs from browser performance resources, and performs session-authenticated requests to collect subscription/paywall metrics. No direct system compromise is evident in this file, but the credential-like handling and internal endpoint automation make it a high-risk supply-chain component that should be reviewed for legitimacy, authorization boundaries, and safe handling of authentication material.

SUSPICIOUS. The skill is largely aligned to subscription analytics, but it achieves this through authenticated browser-session access and X internal web APIs rather than stable official API flows. No clear malware or third-party credential harvesting is present, yet the browser-session scope and internal endpoint inspection create medium security risk.