replay-compare

SUSPICIOUS: The skill’s core behavior matches its stated benchmarking purpose, but its data access is broad for a replay tool: it mines all historical session JSONLs, preserves raw backend payloads, and may import unverified local competitor code. There is no obvious credential harvesting, malicious exfiltration endpoint, or deceptive installer, so this is not malware; however, the scope and retention of potentially sensitive historical queries make it a medium-risk skill.

This is a local query replay and result-writing script; the provided leg implementations are inert placeholders. The unsanitized --legs value is incorporated into a filesystem path, allowing a caller who controls the script arguments to cause writes outside the results directory; severity is a moderate local file-write risk, not evidence of malware.