derive-client

SUSPICIOUS: The skill is internally coherent and uses an official toolchain, so this is not strong evidence of malware. However, it is a high-sensitivity reverse-engineering workflow that captures session cookies, headers, POST bodies, and internal APIs, enabling direct replay and repeated automation against third-party sites; that raises meaningful security and misuse risk despite consistent purpose.