vigolium-scanner

SUSPICIOUS. The skill is internally consistent as a security-testing tool, but it gives an AI agent offensive scanning, autonomous operation, arbitrary JS/extension execution, broad source/traffic ingestion, and credential-bearing authenticated workflows. There is no clear credential-harvesting or hidden exfiltration endpoint in the text, so this is not confirmed malware, but it is a high-risk skill by design.