security-scanner

SUSPICIOUS. The skill is internally consistent as a security-audit workflow and does not show credential theft, covert exfiltration, or malicious installers. However, it gives an AI agent explicit offensive-security scanning capability over arbitrary repositories, which makes it high risk despite otherwise benign data flows and official GitHub CLI usage.