investigate

SUSPICIOUS: the core debugging workflow is coherent and mostly proportionate, but the undocumented `ccw cli` dependency introduces unclear install trust and an undeclared external data flow for logs/code evidence. This looks more like a legitimate debugging skill with medium security concerns than malware.