php-auth-audit

SUSPICIOUS. The skill is internally coherent and does not show credential harvesting, remote installs, third-party data routing, or hidden execution. However, its stated purpose is to perform offensive-style web security auditing with PoC generation against PHP applications, which is high-risk capability for an AI agent and best classified as a security/exploit skill rather than benign developer documentation.