x-api-pentest
Use when the user provides an OpenAPI or Swagger spec and asks to find security issues, pentest the API, audit endpoints for OWASP API Top 10, or check for BOLA, BFLA, mass assignment, injection, or SSRF vulnerabilities in a running HTTP API
80
—
Does it follow best practices?
Impact
—
No eval scenarios have been run
Critical
Do not install without reviewing
Security
2 findings — 2 critical severity. Installing this skill is not recommended: please review these findings carefully if you do intend to do so.
E005: Suspicious download URL detected in skill instructions
What this means
Detected a suspicious URL in the skill instructions that could lead the agent to download and execute malicious scripts or binaries. This includes links to executables from untrusted sources, typosquatting of official packages, URL shorteners that obscure the destination, and personal file hosting services.
Why it was flagged
Suspicious download URL detected (high risk: 0.70). The list mixes reputable docs/tools (sqlmap.org, OWASP, ProjectDiscovery, well-known GitHub projects) with untrusted elements — placeholder/attacker domains (attacker.example, yourdomain.com.evil.example, http://xxxx.oast.fun), INTERACTSH/OAST callback endpoints, and multiple small/low‑reputation GitHub repos (potential typosquatting or personal/tool wrappers) that could host scripts/executables — so treat downloads from the unknown repos and any direct artifacts referenced by the attacker-controlled domains as suspicious until verified.
E006: Malicious code pattern detected in skill scripts
What this means
Detected high-risk code patterns in the skill content — including its prompts, tool definitions, and resources — such as data exfiltration, backdoors, remote code execution, credential theft, system compromise, supply chain attacks, and obfuscation techniques.
Why it was flagged
Malicious code pattern detected (high risk: 0.90). No hidden backdoor or obfuscated remote‑control code was found, but this skill contains multiple explicit, actionable offensive techniques (LLM-based OOB exfiltration via interactsh, SSRF/cloud‑metadata fetch guidance, JWT forging/brute‑forcing and hashcat use, mass‑assignment/admin escalation flows, and automated sqlmap exploitation) that enable clear data exfiltration, credential theft, and privilege escalation if misused.
- Repository
- quangtran88/x-skills
- Commit
6381b15
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.