api-auth-attacks

SUSPICIOUS. The skill is internally consistent as an offensive API-authentication testing guide, but it gives an AI agent high-risk exploit capability against real services and involves live credential/token handling. There is no clear malicious exfiltration path or deceptive installer in the skill itself, so this is better classified as a high-risk offensive security skill rather than malware.