hunt-cors

SUSPICIOUS: the skill is coherent as an offensive CORS-testing guide, but it materially enables exploit activity and optional exfiltration of authenticated data to third-party OOB services. The main security concern is the ambiguous `pip3 install corsy` dependency plus instructions to handle real session cookies and exfiltrate proof data; this is not confirmed malware, but it is a high-risk security-testing skill rather than a benign developer helper.