performing-security-testing

SUSPICIOUS/HIGH-RISK but not confirmed malware. The skill is internally consistent with its stated purpose, but that purpose is to give an AI agent offensive security-testing capability; this is inherently high risk even without malicious exfiltration or deceptive installs.

No overt malicious behavior (exfiltration/backdoor/payload execution) is evident in the provided fragment; however, the script is security-unsafe due to `eval` executing a command string assembled from unvalidated, unquoted user-controlled CLI arguments. If attackers can influence script arguments (e.g., via automation, wrappers, or shared execution contexts), this can lead to command injection and arbitrary shell command execution. Refactor to avoid `eval` (use an argument array with direct `exec`/`nmap` invocation) and add strict input validation/quoting.