add-iron-proxy

SUSPICIOUS: the skill is internally consistent, but its actual footprint depends on a managed interception proxy that sits between clients and official APIs, with centralized credential injection and trusted CA/proxy control. That is not confirmed malware, but it is a high-trust architecture with meaningful confidentiality and integrity risk.