performing-graphql-security-assessment

SUSPICIOUS. The skill’s capabilities fit its stated purpose, but the purpose itself is an offensive security skill for AI agents, which is high-risk by policy. Data flows mostly go to intended target GraphQL endpoints, yet the hosted Voyager upload sends collected schema data to a third-party site, and the graphql-cop install instruction has provenance mismatch. No clear credential theft or hidden execution is present, but the skill is not benign due to offensive use, third-party schema routing, and install-trust concerns.