review-session-management-security

The skill's requests and data flows are coherent with its stated session-security testing purpose, and it specifies no installer, third-party CLI, or external credential service. However, it gives an AI agent hands-on penetration-testing procedures, including state-changing requests, so use should be limited to explicitly authorized applications and test accounts. No evidence of credential theft or malware is present.