cwe-code-review

SUSPICIOUS: the skill is internally coherent and uses local MITRE-derived references without obvious supply-chain or credential-harvesting behavior, but it materially equips an AI agent to perform security analysis and generate exploit PoCs from untrusted code. That offensive capability makes it high-risk as an agent skill even without signs of malware.