Journey Forge Local records browser tasks into local traces, groups them by website capability, and distills those buckets into reusable SKILL.md files for Claude tools. The security angle is not a disclosed bug, but the trust boundary is worth reading carefully because browser events, local APIs, generated skills, and configured LLM calls all sit in the same workflow.