reverse-eng-ida

SUSPICIOUS. The skill’s behavior matches its stated reverse-engineering purpose and keeps analysis traffic on localhost, but it instructs installation of a community GitHub-based bridge via unpinned VCS install instead of the official Hex-Rays MCP distribution. That creates a significant supply-chain risk without clear evidence of malicious data exfiltration or credential theft.