performing-security-testing

SUSPICIOUS/HIGH-RISK skill, not confirmed malware. Its stated purpose matches its capabilities, and the referenced tools are mostly official, but it gives an AI agent offensive security-testing abilities with command execution and dynamic scanning potential, which is inherently high risk. No clear credential theft, hidden data exfiltration, or deceptive install path is present.

No overt malicious behavior (exfiltration/backdoor/payload execution) is evident in the provided fragment; however, the script is security-unsafe due to `eval` executing a command string assembled from unvalidated, unquoted user-controlled CLI arguments. If attackers can influence script arguments (e.g., via automation, wrappers, or shared execution contexts), this can lead to command injection and arbitrary shell command execution. Refactor to avoid `eval` (use an argument array with direct `exec`/`nmap` invocation) and add strict input validation/quoting.