channel-debug-core

No direct evidence of classic malware behavior (no dynamic execution, no backdoor/persistence, no self-exfiltration beyond querying the configured service). However, the module performs privileged admin/log collection using an environment-provided bearer token, optionally sends a protection-bypass header, and writes sensitive admin responses (notably admin logs) to local disk. Treat as high-risk data-access code: security depends heavily on invocation context (trusted URL, controlled ADMIN/BYPASS values, and secure handling/storage of $OUT artifacts).