js-api-extract

SUSPICIOUS: the skill is internally consistent, but its stated purpose is offensive security reconnaissance for API pentesting. There is no clear malware behavior, no installer trust issue, and no credential exfiltration to third-party services, but it equips an AI agent to gather sensitive endpoints and exposed secrets from external targets, which makes it high-risk as an agent skill.