hunt-jwt-crypto

SUSPICIOUS: the skill is internally aligned with its stated purpose, but that purpose is offensive security enablement for an AI agent. It is docs-only and does not hide installs, exfiltration, or credential theft, so it is not confirmed malware; however it materially increases risk by giving exploit workflows, automation paths, and token-forgery guidance that can be used against real targets despite the authorization warnings.