web-security-expert

SUSPICIOUS: the skill is internally consistent, but its purpose is to enable offensive web security testing by an AI agent. It contains no credential theft, hidden exfiltration, or malicious installer behavior, so it is not malware; however, giving an agent exploit guidance and testing payloads is a high-risk capability.