offensive-api-security

The skill is purpose-consistent as an API security audit guide and shows no evidence of credential theft, exfiltration, obfuscation, or malicious installation behavior. However, it provides offensive security-testing capabilities that can be directed at unintended targets; classify it as high security risk, not confirmed malware.