session-fixation

SUSPICIOUS. The skill is internally coherent and does not show credential exfiltration, hidden installs, or malicious data routing, but it is an offensive security skill that teaches an AI agent to detect and exploit session management weaknesses against live targets. Risk is driven by dual-use exploit capability and use of authenticated testing flows, not by malware-like behavior.