vuln-scanner

SUSPICIOUS. The skill’s capabilities broadly match its stated purpose as a vulnerability-disclosure workflow, and its data mostly goes to official GitHub/Resend endpoints. However, it has a large operational footprint: unpinned download-and-execute tooling, execution of untrusted target code, broad GitHub write actions, and autonomous outbound email to third parties. This is coherent for a security-disclosure automation skill, but the autonomy and supply-chain exposure make it high security risk even without clear evidence of credential theft or deceptive exfiltration.