web2-recon

SUSPICIOUS: the skill is internally consistent as a bug-bounty/web recon guide, but its actual footprint is a high-risk offensive security capability for an AI agent. There is no clear credential exfiltration or malware behavior, yet the combination of autonomous scanning, secret/source extraction, and multiple third-party tool chains makes it unsafe and disproportionate for general agent use.