ultrathink-detective

SUSPICIOUS: the skill’s purpose largely matches its behavior, but it centralizes code analysis around a third-party CLI that must be installed and trusted. Same-publisher provenance lowers concern, yet inconsistent claudemem/claude-codemem branding and custom tap usage make the install chain only partially verifiable. No clear credential theft, exfiltration, or malicious payload behavior is present.