My favorite part of this is that for some reason, the HTML document they're using to display (unsanitized) user details in the Skype application has a cookie set that contains the logged in user's login token. Why is that even necessary to display another user's profile?