full-audit

SUSPICIOUS. The skill’s behavior is mostly coherent with its stated purpose of a comprehensive security audit, and there is no clear credential harvesting, covert exfiltration, or malicious installer path. However, it grants an AI agent broad offensive-security and autonomous orchestration capabilities across the entire repository, including red-team attack simulation and many delegated subagents, so the overall security risk is medium-high even though malware evidence is low.