api-auth-and-jwt-abuse

SUSPICIOUS: the skill is internally coherent as an API/JWT testing playbook, but it grants an AI agent explicit offensive security capabilities for auth abuse and rate-limit bypass. The skill body itself shows little direct exfiltration or installer abuse, so malware confidence is low, but operational security risk is high due to offensive-agent use.