pentest-helper

SUSPICIOUS. The visible skill is only a markdown instruction file with no installer, no credential requests, and no explicit exfiltration path, so there is little evidence of malware or supply-chain abuse. However, its stated purpose is to help an AI agent perform penetration-testing tasks, which materially expands offensive capability and is high risk for misuse despite the 'authorized' wording. The main concern is capability scope, not hidden payloads.