hashcat

SUSPICIOUS: the skill is internally consistent and not deceptive, but it equips the agent with offensive password-cracking capability and plaintext credential recovery. Supply-chain and data-exfiltration risk are low; the main risk is the high-impact security tooling itself.