tuzi-danger-x-to-markdown

SUSPICIOUS: the core capability matches the stated purpose, and the Bun install path is plausibly official, but the skill routes sensitive X session credentials/cookies through an unspecified reverse-engineered API. That undisclosed network destination is the main integrity gap; without the actual script or endpoint, credential handling cannot be verified as limited to official X services.

This is a media-localization utility, not evidently malware. In server-side use, untrusted Markdown can trigger SSRF and large downloads. The unsanitized format query parameter may also permit path traversal through the output filename; validate extensions against an allowlist and constrain resolved output paths to the intended directory.

This module is configuration-like, but it embeds and exports a hardcoded bearer token and exposes Chrome-profile-path derivation and cookie-name configuration that strongly suggest downstream automated authenticated access to X. While the fragment itself contains no explicit malicious execution or exfiltration logic, the presence of embedded credential material and local session/credential-handling indicators make the supply-chain security risk high and warrant immediate review of downstream usage, token legitimacy/rotation, and any local cookie-reading behavior.