php-audit-pipeline

BENIGN for intent coherence but HIGH-RISK as an AI-agent capability. The skill’s footprint matches its stated purpose: it is a documentation/methodology pipeline for PHP security auditing, with no embedded installer, no credential requests, no third-party proxy endpoints, and no executable payload in the supplied body. However, it explicitly equips an AI agent to perform offensive-style security analysis across codebases, and if paired with broad file-write/command tools it could be misused against unintended targets. Main concern is capability class, not malware or credential theft.