Is X Token Login safe?

// Runs when user clicks the Login button in the popup.
// Reads whatever text is in the #token input, then injects the Login()
// function into the currently active tab (which must be open on x.com).
document.querySelector('#submit').addEventListener('click', function () {
  const token = document.querySelector('#token').value;  // raw user input, unvalidated
  chrome.tabs.query({ active: true, currentWindow: true }, function (tabs) {
    chrome.scripting.executeScript({
      target: { tabId: tabs[0].id },
      func: Login,      // the function defined below is injected into the x.com page
      args: [token]     // user-supplied token is passed as an argument
    });
  });
});

// Runs inside the x.com tab, not the popup.
// Sets the auth_token session cookie directly using document.cookie,
// bypassing any OAuth or server-side authentication.
function Login(token) {
  const expirationTime = new Date();
  expirationTime.setFullYear(expirationTime.getFullYear() + 1);  // 1 year from now

  // Writes auth_token to the x.com cookie jar:
  //   domain=x.com   → applies to all of x.com
  //   path=/         → applies to all paths
  //   Secure         → only sent over HTTPS
  //   expires        → session persists for 1 year unless explicitly cleared
  document.cookie = `auth_token=${token.replace('"', '')};domain=x.com;path=/;expires=${expirationTime.toUTCString()};Secure`;

  window.location.replace('https://x.com');  // navigate to x.com immediately after
}