exploiting-http-request-smuggling

SUSPICIOUS/HIGH-RISK skill. Its purpose and capabilities align as an offensive security skill, but that purpose itself is dangerous for an AI agent: it provides exploitation guidance against live targets, including bypass and request-capture scenarios. Install trust is mixed: same-org/official references for curl and PortSwigger are reasonable, but direct execution of an unpinned third-party GitHub tool materially raises supply-chain risk. No obvious credential harvesting or covert exfiltration is shown, so this is not confirmed malware, but it is a high-risk offensive capability skill.