security-audit

SUSPICIOUS: The skill is internally coherent for a security-audit purpose and shows no clear credential-harvesting or exfiltration behavior, so it is not malicious. However, it enables offensive-adjacent security scanning and uses unpinned on-demand tool execution (`npx audit-ci`, `pip install pip-audit`), which raises meaningful supply-chain and operational risk.