hunt-ato

The skill is coherent as an offensive account-takeover testing guide and does not show credential harvesting, hidden execution, or an external exfiltration flow. Its detailed brute-force, token-theft, JWT, OAuth, and account-takeover steps are high-impact dual-use capabilities, while authorization limits are underspecified; use only in explicitly authorized testing environments.