personal-data-harvester

SUSPICIOUS: the skill's purpose is plausibly related to personal data import, but its actual footprint is overly broad and privacy-invasive. Standard install sources reduce supply-chain concern, yet autonomous scheduled scraping, session reuse, local cache parsing, and anti-detection guidance make the capability disproportionate to a normal import/sync skill.

No direct evidence of classic malware (backdoor/process execution/remote exfiltration to unknown destinations) is present in this fragment because it is primarily a scraping/collection reference. However, it explicitly enables privacy-sensitive authenticated data harvesting (session cookies, local reading-history caches, highlights/notes) and includes explicit anti-bot/fingerprinting evasion guidance and a localhost intake service for user-provided URLs. These are meaningful security and compliance risks; confirm by reviewing the actual implementation for cookie handling, output storage, authorization on localhost, URL validation, and any outbound exfiltration behavior.

This code fragment is highly aligned with bot-detection evasion and authenticated session automation: it injects stealth fingerprint modifications, simulates human interaction patterns, persists and reuses sensitive cookies across runs, and supports CAPTCHA continuation via human-in-the-loop prompting. While there is no direct indicator of classic malware (e.g., C2/exfil/subprocesses) within this snippet, it is security-relevant due to credential/session replay mechanics and deliberate bypass-oriented design, making it potentially dangerous in a supply-chain context where misuse or cookie compromise could enable unauthorized access.