origin-ip-discovery

The skill is internally consistent and not obviously malware, but it is a high-risk offensive recon skill. Its purpose is to bypass CDN/WAF defenses and expose origin infrastructure, with live probing and port scanning of discovered hosts; install and credential flows appear mostly legitimate, yet the enabled capability is inappropriate for a general AI agent without strict authorization controls.