sync

SUSPICIOUS: the skill’s behavior mostly matches its stated bug bounty sync purpose, but it expands an AI agent’s security-research workflow, pulls untrusted external hunting content into local state, and depends on a same-repo MCP/`uv run` path without strong release-verification evidence. This looks more like a moderately risky offensive-security helper than outright malware.