nuclei

SUSPICIOUS: The skill is internally consistent and uses an official security tool for its stated pentest purpose, so there is no clear credential-harvesting or malware behavior. However, it equips an AI agent with offensive scanning capability and can forward auth tokens to an external CLI, making it high security risk despite low evidence of malicious intent.