cors-check

SUSPICIOUS: the skill is internally coherent and not a credential-harvesting or exfiltration lure, but it equips the agent with offensive web security testing behavior. Since it targets vulnerability discovery on remote endpoints, it carries elevated security risk despite proportionate scope and mostly trustworthy tooling.