security-app-websocket

SUSPICIOUS rather than malicious. The skill’s stated purpose and core behaviors are coherent for a WebSocket security-review overlay, and it includes sensible redaction rules with no obvious exfiltration path. The main issue is execution trust: the workflow depends on an external appsec-sdk CLI whose provenance is not publicly verifiable from the provided evidence, plus broad Bash/write permissions with no manual gate.