php-cmd-audit

Suspicious but not malicious. The skill is internally consistent and does not show credential theft, exfiltration, remote installs, or hidden execution, but it explicitly enables an AI agent to perform command-injection vulnerability discovery and exploitation workflow, making it a high-risk security-audit/offensive capability.