testing-api-authentication-weaknesses

SUSPICIOUS/HIGH-RISK skill. Its stated purpose matches its capabilities, but that purpose is to give an AI agent offensive authentication-testing and bypass techniques against live APIs. Data flows are mostly direct to the target and not overtly exfiltrative, and installer provenance is mixed but generally legitimate. The main concern is disproportionate operational risk from enabling automated exploit-style security testing with real credentials and third-party tools, not confirmed malware.

This module is not classic malware, but it is an offensive-security style API/JWT audit tool. Its inclusion poses a meaningful misuse/abuse risk because it actively probes potentially sensitive endpoints, performs weak HMAC JWT secret recovery attempts from a built-in wordlist, tests token revocation behavior, and attempts account enumeration—while also storing/printing potentially sensitive decoded JWT content and response previews without redaction. If used only in authorized testing contexts it can be legitimate; in an uncontrolled dependency setting it is security-sensitive and should be treated as high-abuse-risk rather than a benign library.