bb-methodology

SUSPICIOUS. The skill is internally consistent as an authorized bug-bounty methodology guide, but it still gives an AI agent offensive security capabilities against real systems, including recon, exploit testing, OOB callbacks, and credential-related validation paths. There is no clear credential harvesting, hidden exfiltration, or malicious installer behavior; the main risk is that the skill's intended function is high-risk offensive use even with stated authorization gates.