web2-recon

SUSPICIOUS: the skill is internally coherent as a web recon/bug-hunting playbook, but its actual footprint is an offensive security toolkit for AI agents with active scanning, fuzzing, monitoring, and credential-backed enumeration. Data flows mostly match stated purpose and official services, so it is not confirmed malware, but the offensive capability and mutable third-party toolchain make it high risk.