exploiting-excessive-data-exposure-in-api

SUSPICIOUS: the skill is internally consistent for authorized API security auditing, but it equips an AI agent with offensive security testing capabilities against live targets. There is no clear credential theft or third-party exfiltration behavior, so it is not confirmed malware; however, it remains high risk because it operationalizes penetration-testing actions and processes sensitive API data.

The code is an API data-exposure scanner, not evident malware. Its main security issues are disabled TLS verification, possible SSRF-like access to arbitrary URLs, command-line exposure of bearer tokens, and storing or printing sensitive data samples. No covert exfiltration or destructive behavior is present. The provided fragment is syntactically incomplete and will not run as shown.