amass

SUSPICIOUS. The skill is coherent with its stated pentest reconnaissance purpose and references legitimate same-project tools, but it gives an AI agent offensive external discovery capability and may use local API credentials via Amass config. There is no strong evidence of malware, credential harvesting, or third-party interception; the main concern is high-risk security tooling and real-world scanning use.