bb-local-toolkit

SUSPICIOUS/HIGH-RISK skill, not confirmed malware. Its offensive-security capabilities align with the stated bug-bounty purpose, but the actual footprint is far broader than a local path helper and equips an AI agent to perform recon, exploitation, CI/CD attacks, AI prompt-injection testing, and exfil-style validation against real targets. Install sources are mostly legitimate developer channels, so this is not deceptive supply-chain malware, but it is a high-risk offensive skill that should not be treated as benign local-tooling guidance.