vnc-pentesting

SUSPICIOUS。该技能与其声明的“VNC 渗透测试”目的基本一致，但它本质上为 AI Agent 提供攻击性安全能力：密码爆破、认证绕过、漏洞利用、截图/文件传输和凭据搜集。再加上从个人 GitHub 仓库 git clone/build 第三方解密工具、无版本锁定和校验，形成高供应链与滥用风险。未见隐藏执行、第三方凭据中转或明确窃密回传，因此不属确认恶意软件，但应视为高风险攻击型技能。

This artifact is not malicious code, but it is an attack-enablement playbook for VNC: it provides actionable reconnaissance, authentication bypass probing, brute-force credential attempts, guidance to decrypt VNC passwords using known keys, and post-compromise automation to capture screenshots and inject commands via the remote desktop. If shipped as part of a dependency unexpectedly, it represents a high security risk due to direct misuse potential (credential compromise and data theft), even though no obfuscated or self-propagating malware logic appears here.