security-benchmark-runner

SUSPICIOUS: the skill is not overtly malicious and shows no direct credential theft or exfiltration, but its stated purpose is extremely generic while its permissions are broad. Unrestricted bash plus write access is disproportionate for an undefined 'security benchmark runner' helper, and the broad auto-trigger on 'security' increases misuse risk.