ctf-osint

SUSPICIOUS. The skill is broadly aligned with CTF OSINT, but it meaningfully expands into active recon and browser automation over untrusted content, creating medium indirect prompt-injection risk. Install sources are mostly legitimate, yet the outdated git-clone-and-run WhatsMyName workflow and unpinned dependencies reduce trust. No clear credential harvesting, covert exfiltration, or malicious third-party routing is present.