hunt-csrf

This skill is coherent with its stated purpose, but that purpose is offensive vulnerability hunting. There is no sign of credential harvesting, hidden exfiltration, or suspicious installers; however, it gives an AI agent practical exploit guidance for authenticated CSRF attacks and ATO chains, making it high security risk as a penetration-testing capability rather than malware.