competition-jwt-claim-confusion

SUSPICIOUS: the skill is coherent with its stated CTF JWT-analysis purpose and shows no direct credential theft or remote execution, but it gives an AI agent offensive JWT exploitation guidance and is distributed through a third-party skills/GitHub trust chain. Main risk is exploit enablement plus moderate supply-chain trust, not confirmed malware.