bb-local-toolkit

SUSPICIOUS. The skill is internally consistent as an offensive bug-bounty/red-team playbook, but that stated purpose itself grants high-risk exploit capability to an AI agent. Install sources are mostly coherent and same-org/official, so this is not confirmed malware; the main concerns are offensive-security enablement, transitive skill chaining, untrusted-content prompt-injection exposure, and explicit system-prompt-extraction guidance.