hunt-lfi

SUSPICIOUS: the skill is coherent with its stated purpose, but that purpose is offensive security exploitation. Its capabilities—target probing, sensitive file access on remote systems, OOB confirmation, and RCE chains—belong to an exploit skill and create high operational risk even with the authorization gate. No clear credential harvesting, covert exfiltration to unrelated endpoints, or fundamentally mismatched behavior is present. The GitHub clone-and-run helper is a moderate supply-chain concern, but same-org provenance makes it an install-trust issue rather than evidence of malware.