web3-audit

SUSPICIOUS: the skill is internally consistent as a Web3 audit playbook, but it gives an AI agent offensive security capabilities for exploit discovery and PoC development against real DeFi targets. No clear credential theft, covert exfiltration, or malicious installer behavior is present, so this is high-risk enablement rather than confirmed malware.