sast-fileupload

SUSPICIOUS: the skill is internally consistent and does not show credential theft, exfiltration, or installer abuse, but it materially expands an AI agent’s offensive security capability by directing autonomous vulnerability discovery across a codebase. Risk comes from enabling security scan behavior and processing untrusted code with subagents, not from malware-like behavior.