web-host-header

SUSPICIOUS: the skill is coherent as a penetration-testing technique guide, but it gives an AI agent explicit offensive security capability for host header injection and password-reset poisoning. There is no evidence of malware, stealth, or supply-chain abuse, yet the attack-focused purpose makes the skill high security risk.