unauth-api-flow-hijack

SUSPICIOUS/HIGH-RISK skill. Its footprint is coherent with its stated purpose, but that purpose is to equip an AI agent with offensive exploitation steps against unauthenticated APIs, including upload, export, replay, and cross-session enumeration. No strong malware or supply-chain evidence appears, but the offensive capability, arbitrary external targeting, file transfer behavior, and disabled TLS checks make it high risk.