hashcat

SUSPICIOUS. The skill is internally consistent and does not show credential theft, covert exfiltration, or malicious install behavior; its pre-execution commands are benign local checks and package-manager guidance points to official distribution paths. However, the skill equips the agent with explicit password-cracking capability, which is a high-risk offensive security function for an AI agent, so overall risk is elevated despite low evidence of malware.