tapd-bug-analyzer

SUSPICIOUS. The skill’s stated purpose matches its behavior, and TAPD access itself is coherent, but it depends on unreviewed external components: a third-party TAPD MCP package and an unseen local sls-trace-analyzer skill. Because secrets are forwarded to external code and a local executable of unknown provenance is central to operation, the overall risk is medium-high despite no direct evidence of malicious exfiltration in the provided text.