mapping-attack-techniques

SUSPICIOUS: the skill’s routing and ATT&CK mapping purpose is coherent, but it supports offensive security workflows and includes a third-party URL-fetch path through defuddle.md that exports requested URLs off-host. There is no confirmed malware, no credential harvesting, and no install-time execution, but the combination of security-operation routing, external-content ingestion, and transitive skill handoff makes this higher risk than a normal documentation skill.