graphql

SUSPICIOUS/HIGH-RISK but not malware. The skill is internally coherent as a GraphQL security auditing skill, with normal code-analysis behavior and no hidden exfiltration path. Risk is elevated because it equips an AI agent to perform offensive security scanning, including live endpoint probing, and it references graphql-cop, whose provenance is weaker than Semgrep’s.