backend-testing

SUSPICIOUS. The skill’s stated capabilities are coherent for backend testing, but it relies on an external CLI whose exact published provenance could not be verified. Because that binary is entrusted with tokens, cookies, and DB connection secrets, the skill carries high supply-chain and credential-forwarding risk even without direct evidence of malicious exfiltration.