claude-authenticity

SUSPICIOUS: the core endpoint-testing behavior is coherent and the install path is benign, but the skill intentionally forwards API keys to arbitrary endpoints and includes explicit system-prompt extraction logic. This is not confirmed malware, yet it is a medium-high risk auditing tool that can expose credentials and hidden instructions when used against untrusted providers.