owasp-zap

SUSPICIOUS: the skill is coherent with its stated purpose, but that purpose is to give an AI agent offensive web security testing capability. Tool provenance is mostly legitimate and same-project, so this is not malware, but it is a high-risk skill due to agent-enabled scanning and interception workflows plus mildly outdated, unpinned install examples.