ghost-validate

SUSPICIOUS: the skill is internally aligned with security-finding validation, but it grants an AI agent offensive testing behavior against live applications and routes that capability through a separate proxy skill/tool chain. No direct malware or credential theft is evident, yet the transitive trust and exploit-testing scope make this a high-security-risk skill.