identity-provider-recon

SUSPICIOUS. The skill is internally consistent as an offensive identity-recon and enumeration playbook, but that stated purpose itself grants an AI agent high-risk security-testing capability against real external targets. There is no obvious malware, credential harvesting, or deceptive third-party routing, yet the active pre-auth user-enumeration workflows and valid-account list generation make the overall skill high risk.