dynamic-debugger

SUSPICIOUS. The skill’s purpose is coherent for a debugger, and its broad filesystem/process access is proportionate to debugging, but the install story for the core dap-mcp dependency is internally inconsistent with upstream evidence. Because the skill depends on an external debugger server and tells users to obtain it through unsupported package channels, install trust is the main issue; I see no confirmed malware or exfiltration behavior in the skill content itself.