hunt-oauth

SUSPICIOUS: the skill is internally coherent as an OAuth bug-hunting guide, but it is a high-risk offensive security skill for AI agents. There is no strong evidence of hidden malware or deceptive credential harvesting beyond the stated exploit purpose, yet the capability set includes token theft, replay, and exploitation steps against external targets, so overall risk is high even with the authorization gate.