web-security-scanner-pro

SUSPICIOUS: The skill is internally consistent as a penetration-testing guide, but it grants an AI agent offensive security capabilities, stealth/WAF-bypass behavior, and batch automation with real-world impact. Install instructions point to a third-party GitHub repo rather than the skill publisher, which raises supply-chain risk even though the repo is public source. No clear credential-harvesting or unrelated exfiltration is shown, so this is high-risk offensive tooling rather than confirmed malware.