owasp

SUSPICIOUS. The skill is broadly aligned with its stated OWASP audit purpose and does not show clear credential theft, external exfiltration, or malicious installer behavior. However, it grants an AI agent high-risk security-audit capabilities in autonomous mode, references unverified follow-on slash commands, and includes silent local telemetry, so the overall footprint is riskier than a normal documentation or linting skill.