metasploit

SUSPICIOUS: the skill is internally coherent for Metasploit use and its install path is official, but it intentionally gives an AI agent offensive security capabilities: payload generation, service scanning, and reverse-shell listeners. That makes it high-risk as an agent skill even without clear malware or credential theft behavior. The pre-execution commands are benign local checks, and the main supply-chain concern is reliance on official but unpinned nightly installers.