hl-security-audit

SUSPICIOUS/HIGH-RISK but not malicious: the skill is internally consistent and mostly well-scoped for a read-only security audit, with no embedded installer or obvious credential-harvesting flow. Its main risk is that it gives an AI agent genuine offensive security auditing capability and broad command-based repo inspection, so it should be treated as a high-risk but purpose-aligned security workflow skill.