hunt-graphql

SUSPICIOUS. The skill is internally consistent as a GraphQL vulnerability-hunting guide, so it is not deceptive malware, but it gives an AI agent offensive security capabilities against arbitrary targets and routes sensitive tokens through network-capable commands and optional third-party tooling. The main risk is exploit enablement and credential forwarding, not hidden exfiltration or obfuscation.