broken-authentication

SUSPICIOUS. The skill is internally consistent as an offensive web-authentication testing skill and does not show covert exfiltration, hidden installs, or credential forwarding to unrelated third parties. However, it equips the agent to perform brute-force, session capture, MFA bypass, and other exploit actions against targets, which makes it high security risk despite the authorization gate and safety language.