webapp-review

SUSPICIOUS. The skill’s behavior is aligned with its stated purpose, but that purpose is itself high risk: it equips an AI agent to autonomously perform active web security testing against targets. There is no clear credential harvesting, hidden exfiltration, or malicious installer path, and the backtick findings appear to be documentation artifacts. Risk is driven by offensive-security enablement and autonomous command execution, not confirmed malware.