supply-chain-attack-recon

SUSPICIOUS: the skill is an AI-agent offensive security recon playbook, which is high-risk even with read-only and authorization language. Its capabilities fit the stated purpose, but that purpose itself grants the agent security scanning and attack-surface discovery behavior, plus optional third-party tool installation; this is not confirmed malware, but it is a risky skill that should be tightly controlled.