pentestcode-ai-pentest-agent

SUSPICIOUS. The offensive capabilities match the skill's stated pentesting purpose, but the footprint is still high risk: it installs a remote script via curl|bash from an apparently different publisher identity, stores discovered credentials, and enables autonomous exploitation workflows including scope bypass. This looks coherent as a pentest skill, not overt credential theft, but it is dangerous and should not be treated as benign.