x-cdp-api

SUSPICIOUS. The skill is internally coherent for bulk X account management and uses official domains plus an official MCP dependency, so it is not confirmed malware. But it leverages a live logged-in browser session, reads cookie-derived auth state, targets undocumented internal endpoints, and provides explicit rate-limit bypass guidance for bulk destructive actions; that makes it high-risk and disproportionate for routine automation.