subdomain-enumeration

SUSPICIOUS overall. The skill is internally coherent for subdomain reconnaissance, but it is an offensive-security skill that directs an AI agent to enumerate external assets, probe hosts, and optionally monitor or expand attack surface. No confirmed credential theft, stealth, or malicious payloads are present, and the flagged config-path reference is documentation context rather than direct secret access. Risk is high because of autonomous recon capability and target disclosure to third-party services, not because of confirmed malware.