owasp-top-10-web

SUSPICIOUS. The skill is internally consistent and avoids installers, credential forwarding, and external data flows, but it is still a high-risk offensive security review capability for an AI agent. Risk comes from enabling structured vuln discovery against web apps, not from malware-like behavior.