ast-deobfuscate

SUSPICIOUS: the skill is internally coherent for JS deobfuscation and uses mostly official npm tooling, so it is not malware-like. However, it handles untrusted code, allows sandboxed execution/verification, mentions an unverifiable MCP component, and provides dual-use reverse-engineering guidance, which makes it a moderate-risk AI agent skill rather than benign documentation.