pentest-tools
主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。 触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。
68
83%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Critical
Do not install without reviewing
Security
4 findings: 2 critical severity, 1 high severity, 1 medium severity. Installing this skill is not recommended: please review these findings carefully if you do intend to do so.
E005: Suspicious download URL detected in skill instructions.
What this means
Detected a suspicious URL in the skill instructions that could lead the agent to download and execute malicious scripts or binaries. This includes links to executables from untrusted sources, typosquatting of official packages, URL shorteners that obscure the destination, and personal file hosting services.
Why it was flagged
These URLs include direct links to executable and script files (e.g., .exe, .ps1, .hta, .sct) hosted on attacker-controlled/untrusted domains, which are high-risk indicators for malware distribution.
E006: Malicious code pattern detected in skill scripts.
What this means
Detected high-risk code patterns in the skill content — including its prompts, tool definitions, and resources — such as data exfiltration, backdoors, remote code execution, credential theft, system compromise, supply chain attacks, and obfuscation techniques.
Why it was flagged
The package is a purpose-built offensive pentest/red‑team toolkit that includes explicit, actionable instructions and snippets for reverse shells, credential theft, data exfiltration, persistence and C2 usage — capabilities that are high-risk and readily abusable if used outside strict authorized testing.
W008: Secret detected in skill content (API keys, tokens, passwords).
What this means
Detected sensitive credentials directly embedded within the skill content, such as API keys, access tokens, private keys, or service-specific secrets. Secrets should never be hardcoded in plain text within skill instructions.
Why it was flagged
I reviewed the listed potential matches and the skill content for high-entropy, directly embedded credentials. - Flagged: the string lstate=515csmxSi1aTO9ysxvJ1Gpmnj7hHuPxjMdfZdEP49lJZ in src-hunter/references/dictionaries/default-credentials-cn.md — this is a long, high-entropy literal presented as a "统一密钥" (a uniform key) tied to a real Wooyun case and therefore appears to be a real secret-like token, not a simple placeholder or example password. It meets the definition of a high-entropy literal that could provide access, so I treat it as a secret to flag. - Ignored (potential_matches JWT tokens): the two JWT_TOKEN values in the pre-filter look like the canonical/example JWT often used in documentation (header.payload.signature with the well-known example signature). They appear as documentation/example tokens (not unique live API keys) and are commonly used in docs/tutorials — treated as examples, not active credentials, so I did not flag them. - Ignored other credentials in the docs: many entries are default or example passwords (admin/123456, admin/admin, etc.) or environment names and installation snippets. Per the rules these are low-entropy setup/default/demo values or placeholders and are not flagged.
W013: Attempt to modify system services in skill instructions.
What this means
The skill prompts the agent to compromise the security or integrity of the user’s machine by modifying system-level services or configurations, such as obtaining elevated privileges, altering startup scripts, or changing system-wide settings.
Why it was flagged
Flagged because the skill explicitly instructs running a PowerShell bootstrap with "ExecutionPolicy Bypass" (bypassing a security control) and recommends starting local services (docker/npx reqable-mcp) that can expose or modify the agent host environment.
Low
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
该 skill 的运行路径会调用本地/目标端工具读取“代理历史/请求响应正文”等由外部目标或用户交互产生的文本（如 Burp 的 proxy_detail、search_history 等基于请求/响应内容检索与分析），从而可能被目标端/外部输入中的间接提示注入内容影响。
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill contains runtime install/run instructions that fetch and execute external code (git clone / docker pull / npx) from external repositories such as https://github.com/ramkansal/pentestmcp.git and https://github.com/reqable/reqable-mcp-server, so these URLs would cause remote code to be fetched and executed at runtime.
- Repository
- zhaoxuya520/reverse-skill
- Commit
3ae5c59
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.