owasp-zap

SUSPICIOUS. The skill is internally coherent and uses official same-org ZAP distribution channels, so it does not look malicious or like credential harvesting. However, it is a high-risk offensive security skill for an AI agent because it enables active scanning against external systems and can create public GitHub issues containing sensitive findings; use should be tightly permissioned and restricted to authorized targets.