dependency-confusion

SUSPICIOUS/HIGH-RISK. The skill is internally coherent as a dependency-confusion red-team playbook, but it equips an AI agent with offensive supply-chain testing steps, transitive routing to another skill, third-party security tooling, and callback-based execution proofs. File/config references are mostly documentation, not direct credential theft, yet the overall capability is high risk because it enables exploit-style actions beyond passive review.