hunt-csrf

SUSPICIOUS: the skill is internally aligned with its stated purpose and does not show credential theft, hidden exfiltration, or malicious supply-chain behavior, but it equips an AI agent with active offensive security procedures and exploit validation steps. The main risk is granting an agent penetration-testing capability against real targets, even with stated authorization gates.