testing-apis

SUSPICIOUS. The skill is internally coherent for API pentesting, but it gives an AI agent offensive security capabilities with real external effects, including fuzzing, auth bypass attempts, injection testing, and rate-limit stress. The flagged network actions are mostly documentation-consistent rather than covert exfiltration, and the only notable supply-chain issue is an unpinned same-org GitHub clone/execute example for RESTler. Not malware, but high operational/security risk due to offensive use and external target interaction.