hunt-spa-api

SUSPICIOUS. The skill’s behavior matches its stated purpose, but that purpose is to give an AI agent offensive security capability against live targets. There is no obvious credential harvesting, hidden exfiltration endpoint, or malicious installer in this skill, and the confirmation gate is a real limiting control. Still, teaching the agent to enumerate targets, extract secrets/routes, and actively probe APIs for auth flaws is high-risk and outside normal benign developer-workflow scope.