mx-core-local-auth

SUSPICIOUS: the skill is internally consistent for local-development verification, with no supply-chain or exfiltration behavior, but it directly bypasses authentication by minting owner sessions from DB and secrets. That makes it high-impact and risky, though not clearly malicious, if strictly confined to a confirmed local dev environment.