merlin

SUSPICIOUS. The skill is coherent with Merlin’s upstream functionality, but that functionality is an AI-operated offensive C2 framework with covert transport, remote command execution, file transfer, and credential-dumping. Official GitHub sourcing lowers pure malware confidence, yet the skill remains high security risk because it equips an agent to conduct post-exploitation actions on remote systems.