web-deserialization

SUSPICIOUS. The skill is internally coherent as an insecure-deserialization exploitation guide, but its actual function is to help an AI agent generate and deliver RCE payloads against target systems. No clear credential harvesting or deceptive install path is present, and the .config finding is contextual, but the offensive-security purpose and OOB callback workflow make it high security risk.