melech-debug-mode

SUSPICIOUS: the skill is largely coherent with its stated local UI debugging purpose and keeps probe traffic local, but it expands trust by directing installation of a companion skill and unpinned external tooling. This is not strong evidence of malware or credential theft, yet the transitive skill install and mutable dependencies make the overall footprint medium risk.

No clear evidence of malicious code (no outbound exfiltration, no command execution, no dynamic payload execution, no system modification outside its own session directory) is present in this module. The main security concerns are design-related: bearer-in-URL token authentication with no additional safeguards, permissive CORS/private-network headers, heuristic key-name-only secret filtering, and verbatim persistence of accepted JSON payloads to disk (plus potential DoS due to fsync per event). Overall: likely a benign debug collector, but high privacy/security risk if exposed or misconfigured.