agentic-security-scanner

Overall suspicious rather than malicious. The skill’s scanning purpose aligns with its stated capabilities and its local binary requirements are proportionate, but the install story has notable trust issues: a non-verifiable GitHub repo and a transitive `npx skills add` path through an external CLI. No direct credential harvesting, covert exfiltration, or destructive behavior is evident from the provided skill text.