offensive-osint

SUSPICIOUS: the skill’s stated purpose matches its capabilities, but that purpose is to equip an AI agent with offensive reconnaissance and credential-validation workflows. It is not confirmed malware, yet it is a high-risk security skill due to offensive-agent enablement, broad external-tool installation, and outbound data/credential flows.

The visible fragment is a credential-triage guide that queries provider APIs and prints account, workspace, collection, environment, file, and user data; Postman environment values may expose secrets. It also gives actionable JWT cracking and alg=none testing commands, while explicitly restricting mutation/cracking to approved labs. No hardcoded live credentials, covert exfiltration destination, or autonomous malicious behavior is shown; severity is elevated if used with unauthorized credentials because it enables sensitive-data enumeration and token attacks.