flux-recon

SUSPICIOUS: the skill's core purpose is legitimate and mostly aligned, with no malicious installer or explicit exfiltration path, but it is over-broad in reading secret-bearing config files and references an undefined /atlas-report handoff. Risk is driven by sensitive credential discovery plus outbound/reporting capability, not confirmed malware.