melange-qcom

SUSPICIOUS. The workflow is internally consistent with a Qualcomm model-management skill, but it requires an unverifiable `melange-qcom` CLI and routes Melange API credentials through it. Because the binary's official provenance is not established and it handles credentials plus model data, this is high security risk even without proof of malicious intent.