web3-audit

SUSPICIOUS: the skill is internally consistent as a web3 audit guide, but its purpose is to give an AI agent offensive security capability for real smart-contract targets. There is no clear credential theft, hidden exfiltration, or deceptive install path, so this is not confirmed malware; the main concern is high-risk exploit enablement.