xray

Mostly coherent local-inspection skill with no evident exfiltration or credential harvesting. Main risk is reliance on an unverifiable local CLI for the skills subcommand plus broad access to hidden Claude memory across projects; treat as suspicious-but-not-malicious due to trust and scope concerns, not malware behavior.