nikto

SUSPICIOUS. The skill is internally coherent and uses legitimate tooling, but it is a high-risk offensive security skill that enables an AI agent to perform active web vulnerability scanning and optionally use real credentials/cookies during scans. No strong malware or exfiltration indicators are present; the main risk is the agent’s security-testing capability itself.