hunt-saml

SUSPICIOUS/HIGH-RISK skill. Its footprint is coherent with its stated purpose, but that purpose is to enable offensive SAML exploitation, including auth bypass, ATO, XXE, and privilege escalation against live SSO systems. Install trust is mixed: SAMLRaider has a plausible official distribution path, while 'samlmagic' remains unverified. No strong malware indicators or covert credential theft are present, but the operational security risk is high because the skill arms an AI agent with exploit procedures against authentication infrastructure.