web-csrf

SUSPICIOUS: the skill is internally consistent and not deceptive, but it equips an AI agent with offensive CSRF exploitation guidance. No clear malware, exfiltration, or supply-chain abuse is present; the main risk is enabling unauthorized web attacks.