security-audit

SUSPICIOUS: the skill is internally consistent and not overtly malicious, but it equips an AI agent with offensive security and penetration-testing capability. Install provenance appears legitimate, so the main concern is the high-risk capability itself and the transitive trust of the skills CLI, not credential theft or covert exfiltration.