scanning-input-validation-practices

SUSPICIOUS: The stated purpose is coherent, but the skill offloads its core behavior to a third-party plugin with unclear provenance, mutable install refs, and inconsistent catalog/repository attribution. There is no clear evidence of credential theft or exfiltration, so this is not confirmed malware, but the transitive supply-chain trust is material and insufficiently documented.