check-tools

SUSPICIOUS. The core behavior—checking for pentesting tools—is aligned with the stated purpose, and the local discovery commands do not exfiltrate data. However, this is an offensive-security skill, and one install path (`go install` for Skipfish) has unclear official provenance, raising supply-chain concern disproportionate to a simple checker.