dp-session-forensics-cloud

SUSPICIOUS. The skill’s behavior is mostly aligned with its stated forensic purpose, and data appears to flow to same-vendor DeepWorks domains rather than third-party proxies. Risk comes from direct handling of sensitive conversation transcripts, token use via .env or desktop sync, and reliance on undocumented internal APIs/helper code that are not publicly verifiable from the provided evidence.