debug-bridge

SUSPICIOUS: The skill's broad browser-control and telemetry capabilities are largely aligned with its debugging purpose, and data stays on localhost rather than a third-party service. However, it exposes sensitive browser state and network bodies, allows arbitrary in-page JS execution, and enables autonomous UI actions with potentially real-world consequences; combined with unverified package provenance, this makes it medium risk rather than benign.