symmetric-cipher-attacks

The skill is internally consistent and does not show malware traits, credential harvesting, covert exfiltration, or suspicious installer behavior. However, it is a high-risk AI-agent skill because its stated purpose is to teach and enable offensive cryptographic exploitation workflows; the main risk is capability misuse, not deception or hidden behavior.

No direct evidence of supply-chain malware (no exfiltration, backdoor/persistence, credential theft, or obfuscated runtime payloads) is present in this fragment. The security concern is dual-use misuse: it provides implementable guidance for breaking/enumerating weaknesses in common cryptographic constructions (padding oracles, malleability via CBC bit-flipping, ECB oracle attacks, PRNG state cloning, and GCM nonce-reuse exploitation). If distributed as a dependency, its main impact is enabling attackers to exploit vulnerable implementations rather than performing malicious actions itself.