ai-pentesting

SUSPICIOUS. The skill’s behavior is broadly aligned with its stated purpose, and the Shannon install path appears to use official same-org npm/GitHub/Docker channels rather than an obvious malware lure. However, this is an offensive-security skill that enables autonomous pentesting, exploitation, and CI-driven active scanning, with credentials and sensitive findings flowing through external tooling and containers. That makes it high risk for AI-agent use even without evidence of outright malware or credential theft.