wfuzz

The skill’s capabilities and data flows match its stated purpose, and there is no indication of credential harvesting or covert exfiltration. HTTP fuzzing is an offensive security capability and should be used only on authorized targets; the unpinned package install adds limited supply-chain risk.