raven-zero-day-hunter

SUSPICIOUS rather than malicious. The skill is largely coherent with its stated DevSec review purpose and uses mostly official GitHub-facing data flows, but it gives an AI agent substantial security-audit capability, executes analysis tooling on untrusted code, and can autonomously influence merge outcomes. No clear credential harvesting or deceptive exfiltration is present, so this is high-privilege defender automation with moderate security risk, not confirmed malware.

SUSPICIOUS: the skill is internally coherent as a security-detection front end, but it grants an AI agent substantial security-scanning and continuous-monitoring capability over sensitive private artifacts and live telemetry. The main concerns are agentic offensive-security functionality, unclear provenance of the referenced internal implementation, and incomplete disclosure of external data-routing details rather than confirmed malware or credential theft.