subfinder

SUSPICIOUS. The skill is internally coherent for authorized passive reconnaissance and uses legitimate ProjectDiscovery tooling, so there is no strong malware signal. However, it gives an AI agent external recon capability and depends on preinstalled third-party security CLIs that may perform network collection and optional credential-backed source queries, making the overall security risk medium-high despite low evidence of malicious intent.