api-security-testing

HIGH RISK but not confirmed malware. The skill is internally consistent with an API pentesting purpose, and the Strix dependency appears same-org and officially documented. However, it gives an AI agent offensive security capability and forwards sensitive API tokens, including admin credentials, into an external CLI, so the overall risk is substantial even without clear deception or exfiltration.