rev-u3d-dump

SUSPICIOUS. The skill’s capabilities are mostly aligned with its reverse-engineering purpose and it does not harvest credentials or exfiltrate data, but it instructs the agent to fetch and execute a personal fork from GitHub without release verification or checksums. This makes it a medium supply-chain risk rather than clear malware.