security-auditor

SUSPICIOUS. The skill is purpose-aligned as a security auditing tool and shows no external installer or obvious exfiltration path, but it grants an AI agent high-risk offensive security capability, including exploit PoC generation, while processing untrusted repository content with Bash and Write access. This is not confirmed malware, but it is a high-risk security skill that could be misused or prompt-injected.