Web Application Security Testing

SUSPICIOUS: the skill is internally consistent as a web-app pentesting guide, and its install path is relatively normal, but it gives an AI agent high-risk offensive security capabilities, including payloads that can extract data, trigger callbacks, and probe cloud metadata. This belongs to its stated purpose, so it is not confirmed malware, but it is a high-risk security-testing skill that should be tightly controlled and limited to explicitly authorized targets.

The code is an authorized-use API security scanner with active testing behavior, not apparent malware. It contains a significant transport-security weakness because all TLS certificate validation is disabled, and it has operational risks from active login/request probing and command-line token handling. No credential theft, exfiltration, persistence, destructive behavior, or hidden network destination is present in the supplied fragment. The fragment also cannot run as written because of incomplete syntax at DISCLAIMER and the final main call.