nuclei-scan

SUSPICIOUS: the skill is internally consistent and uses official ProjectDiscovery install paths, so it is not malware-like or deceptive. However, it gives an AI agent active vulnerability-scanning capability against network targets, which is a high-risk security/exploit function; supply-chain risk is moderate due to unpinned upstream installs and template updates.