test-site

SUSPICIOUS. The skill’s core browser-testing behavior is largely consistent with its stated purpose and its network flows stay on official Microsoft/Power Pages domains or the tested site. Risk comes from executing unverifiable local plugin scripts, handling authenticated same-origin tokens for API replay, and mixing untrusted web content ingestion with file-write/exec capability; these are proportionate enough to avoid a malicious label but too broad to call fully benign.