hunt-oauth

SUSPICIOUS/HIGH-RISK skill. It is internally consistent as an OAuth bug-hunting playbook, but its purpose is offensive security against arbitrary targets and it provides concrete account-takeover and token-theft procedures. No strong malware or hidden exfiltration is present, yet the skill materially enables exploitation and autonomous misuse.