bug-hunt

The skill is mostly coherent with its stated bug-hunting purpose and shows no installer, credential-harvesting, or off-platform exfiltration behavior. Its main risk is autonomous public/project actions—opening PRs, issues, and comments—plus some trust ambiguity around referenced companion skills, so it is best classified as suspicious/high-vulnerability rather than malicious.