flaw0

SUSPICIOUS. The stated purpose is coherent for a security scanner, but the trust story for the `flaw0` executable is weak: placeholder publisher metadata, unverified npm package provenance, and credential forwarding of `ANTHROPIC_API_KEY` into that tool. There is no clear evidence of confirmed malware or overt exfiltration, but the install and credential flow are disproportionally risky for an unverifiable scanner package.