agency-security-engineer

SUSPICIOUS. The skill is largely coherent as a defensive security-engineer guide and shows no credential harvesting, exfiltration endpoints, hidden installs, or unverifiable binaries. However, it equips the agent with penetration-testing/offensive security behavior, which is high-risk for AI-agent use, and its CI examples have moderate supply-chain hygiene issues (`@master`, deprecated action).