hunt-spa-api

SUSPICIOUS/HIGH-RISK skill. The content is internally consistent with its stated purpose, but that purpose is to equip an AI agent for offensive API reconnaissance and auth-bypass testing on live targets. There is no malicious installer, no hidden credential theft, and no third-party data relay, so this is not confirmed malware; the risk comes from enabling active penetration-testing behavior with real-world external impact.