js-reverse

SUSPICIOUS: the stated purpose matches the capability set, but the skill is high-risk because it equips an agent for JS reverse engineering against live targets and bootstraps external tooling through mutable npm/GitHub install paths. No clear credential harvesting, covert exfiltration, or malicious endpoint routing is shown, so this is not confirmed malware; the main concerns are dual-use offensive scope and supply-chain trust.