performing-authenticated-scan-with-openvas

SUSPICIOUS. The skill’s behavior is largely coherent with its stated purpose of authenticated vulnerability scanning, but it is a high-risk security/penetration-testing capability for an AI agent and it handles powerful credentials, including an example that reads a raw SSH private key from disk. Install sources are mostly official or distro-backed, so this is not confirmed malware, but the stale container instructions and credential-heavy workflow make the skill materially dangerous.

The template describes legitimate OpenVAS authenticated scanning and contains no apparent malware or intentional sabotage. It presents a high-impact credential and privilege configuration: /etc/shadow access, optional broad sudo membership, Windows Local Administrator access, and ESXi root authentication. Use dedicated least-privilege accounts, avoid /etc/shadow access unless required, restrict sudoers precisely, replace root and local-admin credentials where possible, store secrets in a vault, rotate them, and protect scan reports. The security risk reflects credential-compromise and over-privilege exposure, not malicious behavior in the supplied fragment.