darkmoon-pentest

SUSPICIOUS/HIGH-RISK but not confirmed malware. The skill is internally coherent for its stated purpose and routes credentials to the user's self-hosted Darkmoon Pro instance, but it equips an AI agent to initiate real offensive security actions. The main risks are the high-impact autonomous pentest capability and the unpinned `npx -y` execution path; there is no strong evidence of credential harvesting or covert exfiltration.