audit-base

SUSPICIOUS: The skill is internally coherent for security auditing, and its main installs come from the official ProjectDiscovery org, so this is not confirmed malware. However, it is a high-risk offensive-security skill for an AI agent, uses unpinned tool installs, and extends trust to third-party template/prompt repos without verification or authorization safeguards.