penetration-testing
Audited by Socket on Feb 16, 2026
1 alert found:
Malware[Skill Scanner] Installation of third-party script detected All findings: [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] [CRITICAL] command_injection: URL pointing to executable file detected (CI010) [AITech 9.1.4] [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] The skill is coherent and purpose-aligned for legitimate security testing within a Kali MCP environment. It provides structured methodology, tool usage, logging, and reporting without embedding covert data flows or external data sinks. The explicit exploitation preparation notes and reverse-shell examples require strict authorization, scope control, and controlled environments to prevent abuse. Recommended enhancements focus on formal authorization prompts, scope boundaries, and automated governance hooks to reduce misuse risk while preserving instructional value. LLM verification: The skill is a legitimate, explicit guide for penetration testing using Kali tooling. It is not itself obfuscated or containing obvious backdoors or exfiltration code, but it contains high-risk operations: installing offensive tools and downloading/executing third-party scripts without integrity checks. These behaviors present supply-chain and misuse risks rather than clear malicious intent. Recommend adding integrity verification, strict sandboxing guidance, and an enforceable authorization che