hunt-cors

SUSPICIOUS/HIGH-RISK but not confirmed malware. The skill is internally aligned with its stated purpose as a CORS hunting guide, but that purpose is itself an offensive security capability for an AI agent. Risk is driven by exploit guidance, use of live session cookies, and explicit optional exfiltration of sensitive response data to OOB services; supply-chain concern is moderate due to the poorly verified `corsy` install reference.