orca-sec-scans

SUSPICIOUS: the skill is broadly aligned with a security-scanning purpose, and the Trivy installer is official same-org Aqua documentation rather than a random payload. Risk comes from auto-install via curl|sh, active live probing of targets, insecure curl -k examples, and the ability to move from scanning into applying fixes; this is a high-capability security-audit skill rather than a benign read-only helper.