pentest-lyan-web-security-testing

SUSPICIOUS: the skill is internally coherent for pentesting, but it grants an AI agent offensive security capability, stores credentials in plaintext, and relies on a direct GitHub clone/unpinned dependency path with a publisher-identity mismatch and an inconsistent Playwright package reference. No clear credential exfiltration to attacker-controlled endpoints was shown, so this is not confirmed malware, but it is high-risk and should not be trusted casually.