java-audit-skill

SUSPICIOUS. The skill is internally coherent as a Java security-audit workflow, but it grants an AI agent high-risk offensive security review capability and combines untrusted code ingestion with command/file actions. No clear credential theft or malicious exfiltration is present, so this is not confirmed malware; the main concern is powerful security-audit functionality and prompt-injection exposure during analysis.