vulnerability-scanner

SUSPICIOUS: the skill’s stated purpose and actual capabilities are broadly aligned, and there is no clear credential theft or hidden exfiltration. However, it is still a security-scanning skill for AI agents, which materially increases misuse risk; the helper script also executes an external tool (`npm audit`). Overall this looks like a coherent but higher-risk security workflow skill rather than malware.