read-x-markdown

SUSPICIOUS. The visible skill is broadly aligned with converting X content to markdown, and its local file access is proportionate. The main concerns are unpinned `npx` runtime execution, use of a reverse-engineered API, and fallback browser-cookie/session handling. Because the referenced script is missing, the real credential and network flows cannot be verified; this uncertainty keeps the risk above benign but below malicious.

This module is strongly security-sensitive because it automates collection of X/Twitter authentication cookies using local browser CDP (Target/Network.getCookies), supports ingesting authentication secrets via environment variables, and can write harvested cookies to disk and emit them as an HTTP Cookie header. No overt backdoor/exploit primitives are visible in the snippet, but the functionality is credential/cookie harvesting oriented; misuse, unsafe logging, weak file permissions, or downstream misuse of the produced Cookie header would create a high-impact supply-chain/data-theft risk.

This module is a configuration/constants file that is likely used to perform authenticated/automated interaction with X/Twitter. The presence of a hardcoded exported bearer token and exports that strongly indicate use of local browser session/cookies (cookie names + derived Chrome profile path) creates a high secret-exposure and credential misuse risk. No direct malicious actions are visible in this fragment, so malware intent is not proven, but security review/secret rotation and validation in consuming modules is warranted.