hunt-idor

SUSPICIOUS. The skill is internally consistent as an offensive security/bug-bounty hunting guide, but that purpose itself gives an AI agent actionable exploit-testing capability against arbitrary targets. There is no evidence of malware, hidden exfiltration to attacker infrastructure, credential harvesting via third-party services, or suspicious installers; however, the agent-facing instructions enable probing, enumeration, and potentially destructive authorization testing, so overall security risk is high even though malicious intent is not confirmed.