testssl-sh

SUSPICIOUS: the skill is internally consistent and does not show credential theft or hidden exfiltration, but it grants an AI agent active security-scanning capability against external hosts. Supply-chain risk is modest because the referenced tool appears to be an official upstream project, yet the agent-use case remains high risk due to offensive network probing potential.