hunt-host-header

SUSPICIOUS: the skill’s behavior is coherent with its stated purpose, but that purpose is to give an AI agent offensive web exploitation capabilities. It directs active attacks, OOB token capture, cache poisoning validation, and SSRF probing against target infrastructure; there are no notable supply-chain concerns, but the real-world attack capability and explicit exfiltration flows make it high risk.