vhost-enumeration

SUSPICIOUS: the skill is internally consistent for virtual-host discovery and shows no credential theft or covert exfiltration, but it gives an AI agent active offensive reconnaissance capabilities against arbitrary targets. Supply-chain risk is limited because the skill does not install anything itself, yet the overall security risk is high due to the penetration-testing nature and command/network access required.