hunt-spa-api

SUSPICIOUS: the skill is internally consistent and has no supply-chain or credential-harvesting signs, but its actual purpose is to give an AI agent offensive web testing capability against live targets. Risk comes from enabling autonomous security probing and access-control testing, not from malware-like exfiltration or hidden installs.