use-pxpipe

SUSPICIOUS: the skill's purpose and core capability are aligned, and the install path appears to be the project's official documented npm route rather than an obviously malicious payload. However, it introduces an inline local proxy for all Claude session traffic, exposes captured context through an unauthenticated dashboard/log, uses broad read scope, and relies on an unpinned young external tool. This is not confirmed malware, but it is a meaningful security/privacy risk and should be treated as a cautious opt-in developer workflow hack rather than benign low-risk guidance.