tools-hashcat

SUSPICIOUS: the skill is internally coherent and does not show credential exfiltration or deceptive third-party routing, but it gives an AI agent explicit offensive password-cracking capability over sensitive credential artifacts. Install trust is relatively normal; the main risk is the high-impact offensive function itself, not malware-like behavior.