web-vuln-oauth

SUSPICIOUS: the skill is internally coherent and uses proportionate tooling for OAuth/OIDC testing, with no notable supply-chain abuse or credential harvesting. However, it grants an AI agent explicit offensive security capability against live authentication systems, making it a high-risk vulnerable skill rather than confirmed malware.