web-vuln-idor

SUSPICIOUS/HIGH-RISK skill. Its behavior is coherent with its stated purpose as an IDOR testing aid, so it is not confirmed malware, but it gives an AI agent offensive security capabilities, handles live credentials, disables TLS verification, and automates broad remote probing and enumeration. No third-party credential exfiltration is present, yet the skill is still dangerous and high-risk to enable.