penetration-testing

High-risk offensive security skill. Its capabilities are internally consistent with its stated penetration-testing purpose, so it is not deceptive malware, but it gives an AI agent explicit attack, exploitation, credential-hunting, and post-exploitation abilities, plus some download-and-execute supply-chain exposure. Overall verdict: SUSPICIOUS/HIGH RISK rather than confirmed malicious.

The script is a legitimate-looking penetration-testing enumeration utility and contains no clear malware, exfiltration, persistence, or backdoor behavior. However, it has a high-impact command-injection flaw because the user-controlled TARGET value is embedded in bash -c strings for FTP testing and banner grabbing. The script should pass TARGET as a separate shell argument, validate it as an IP address or hostname, and avoid unprompted package installation where possible.