wstg-web-pentest

SUSPICIOUS: the skill is internally aligned with its stated purpose as a web pentest methodology, but that purpose is itself high risk for an AI agent because it enables offensive scanning, exploit testing, state-changing actions, and OOB callback workflows. There is no strong evidence of hidden credential theft or malware, but the capability set is dangerous and should be tightly permissioned.