waf-bypass-agent

SUSPICIOUS: the skill is internally coherent, but its stated purpose is to give an AI agent offensive WAF-bypass capability against external systems. The provided content shows no credential theft or hidden exfiltration, so it is not confirmed malware, but it is high-risk due to exploit-oriented autonomy and a moderately weak GitHub+npx install trust path.