microsoft-security-skills-plugin

SUSPICIOUS. The skill’s stated purpose largely matches its content: it is a documentation-heavy Microsoft security guidance pack with example calls to official Microsoft endpoints, and the scanner’s command-injection hits are false positives from code samples. The main concerns are provenance and trust-chain scope: the package presents Microsoft-focused authority but is published from a personal GitHub repo, and it instructs agents/hosts to install remote skill content through APM, npx skills, and Gemini extensions. That is disproportionate enough to warrant caution, but there is no clear credential theft, hidden execution, exfiltration, or malicious data routing.