web-dependency-confusion

MALICIOUS. The skill's stated purpose is to perform an active dependency-confusion attack: harvest internal names, publish attacker-controlled packages, and receive OOB callbacks from target CI/build systems. Its data flows, third-party callback sink, and use of sensitive registry config are fundamentally aligned with offensive exploitation, not normal development workflow.