web-security-testing

SUSPICIOUS. The skill’s purpose and capabilities are internally aligned, but it equips an AI agent to perform offensive web security testing, including intrusive techniques, and delegates to other unverified sub-skills. There is no direct credential harvesting, exfiltration endpoint, installer, or malware behavior in this skill itself, but the autonomous security-testing scope and transitive skill invocation make it high risk.