ctf-osint

SUSPICIOUS. The skill is internally consistent as a CTF OSINT guide, but it gives an AI agent offensive reconnaissance capabilities, encourages direct use of raw tokens/API keys, and processes untrusted external content at scale. There is no clear malware behavior, no third-party credential proxying, and no installer/download-execute chain, so the main issue is high operational security risk rather than confirmed malicious intent.