web-app-security

SUSPICIOUS: the skill is internally consistent as a web-app pentesting guide, but it equips an AI agent with offensive security testing and exploitation capability against external systems. No direct credential theft or malicious exfiltration is shown, and supply-chain risk is low in the provided text because no installer chain is included.