detecting-shadow-api-endpoints

SUSPICIOUS. The skill is coherent with its stated API-security purpose and uses official/local tools without suspicious data routing, so it is not malicious. However, it meaningfully increases an AI agent's reconnaissance capability against live environments and requires broad enterprise visibility, making it high-risk dual-use security tooling.