vulnhunter-security-scanner

The skill is coherent with its stated purpose and routes credentials to official Anthropic/GitHub endpoints in the described paths, so I do not see evidence of malware or credential harvesting. However, it is still a higher-risk skill because it equips an AI agent for security-vulnerability hunting and code-affecting workflows, and it is installed from mutable source with repo-defined dependencies rather than a strongly verified release path.