drop terminal firmware dump + memory · detect skimmer firmware patterns + skimmer-injected calls · runs locally
drop terminal firmware dump + memory · local only
heuristic screener · vendor schema varies · not definitive proof