forge-debugger

SUSPICIOUS. The core capabilities mostly match the stated purpose of debugging Forge apps, and installer provenance is consistent with Atlassian's official npm-distributed CLI. The main risk is the execution mandate: the skill authorizes the agent to autonomously run commands, edit code, deploy changes, and install/upgrade apps on user or customer sites without explicit per-action approval. This is proportionate to troubleshooting but still medium risk because it enables real-world changes. No evidence of credential exfiltration, malicious data routing, obfuscation, or unverifiable binaries was found.