java-route-tracer

SUSPICIOUS. The core static-analysis and decompilation behavior broadly matches the stated purpose, but the skill is an offensive security auditing tool and its documented installer path downloads and executes CFR from a non-official proxy without verification. No credential theft or exfiltration is evident, so this is not confirmed malware, but the supply-chain and exploit-tool risks are materially elevated.