trevorspray

The skill is not disguised malware, but it is a high-risk offensive security skill whose purpose is to conduct password spraying and account enumeration against external identity systems. Its capabilities align with its stated purpose, yet that purpose itself gives an AI agent attack functionality with real-world impact; upstream install provenance appears same-org but uses weaker unpinned VCS installs.