cve-2026-31431-copy-fail

SUSPICIOUS. The capability matches the stated purpose because this is openly an exploit/LPE skill, but that purpose itself gives the agent offensive privilege-escalation behavior with real host impact. The main flagged issue is supply-chain trust: execution comes from an unrelated GitHub repo with weak release provenance. Even without clear malware indicators or credential theft, this is a high-risk skill because it operationalizes local exploitation and root-shell access.