api-auth-and-jwt-abuse

SUSPICIOUS. The skill is internally consistent and does not show supply-chain or exfiltration behavior, but it is an offensive API/JWT abuse playbook for an AI agent. Risk is driven by enabling active security testing and bypass techniques, not by malware-like behavior.