acidrain-security-testing-toolkit

SUSPICIOUS. The stated purpose and capabilities largely align for a security-testing skill, but the install trust is weak because the skill published by ara.so directs users to clone an unrelated personal GitHub repository with inconsistent structure and limited provenance. No confirmed credential theft or hidden exfiltration is shown, so this is better classified as a high-risk vulnerable/offensive skill rather than malware.