Security audit

Awesome Pentest

Security checks for vulnerabilities and agentic risk

Overview

This skill is marketed as a penetration-testing resource browser, but the bundled scripts are either placeholders or a local logging interface that can retain sensitive-looking inputs without clear disclosure.

Review carefully before installing. Do not enter passwords, tokens, internal hostnames, vulnerability notes, or assessment data into this tool unless the storage behavior is fixed and clearly documented. The package should either implement the advertised pentest-resource browsing functionality or be rewritten to disclose and protect any local data it records.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:141
Finding: Sensitive Inputs Are Persisted in Plaintext Logs
Content: View full analysis
/dev/null || echo " No entries yet. Use: awesome-pentest check-strength " else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/check-strength.log" local total=$(wc -l < "$DATA_DIR/check-strength.log") echo " [Awesome Pentest] check-strength: $input" echo " Saved. Total check-strength entries: $total" _log "check-strength" "$input" fi ;; ``` The shared storage and logging implementation is defined at lines 6–9: ```bash DATA_DIR="${HOME}/.local/share/awesome-pentest" mkdir -p "$DATA_DIR" _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; } ``` Equivalent plaintext behavior is repeated in handlers such as `generate`, `rotate`, `store`, `retrieve`, `hash`, and `verify`. ### Technical Analysis The `check-strength` command name reasonably implies that users may provide passwords, passphrases, or other authentication material. Instead of evaluating the input without retaining it, the handler writes the complete value to `check-strength.log`, prints it to standard output, and passes it to `_log`, which creates a second plaintext copy in `history.log`. Other security-related commands use the same generic implementation. In particular, `hash` does not hash its input, and `store` does not encrypt it. The files are created using the caller's current `umask`; the script does not explicitly enforce mode `0600` for files or mode `0700` for the data directory. The `recent`, `search`, and `export` features c ...[truncated 1255 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/script.sh:101
Finding: Search Terms Beginning with a Hyphen Are Interpreted as grep Options
Content: View full analysis
}" echo "Searching for: $term" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local m=$(grep -i "$term" "$f" 2>/dev/null || true) if [ -n "$m" ]; then echo " --- $(basename "$f" .log) ---" echo "$m" | sed 's/^/ /' fi done } ``` ### Technical Analysis Shell quoting prevents word splitting and shell metacharacter expansion, but it does not prevent a command from parsing an argument as an option. Because the script does not place `--` before the user-controlled pattern, a search term beginning with `-` can be interpreted as a `grep` option. For example, an option-style argument such as `--file=/dev/zero` can cause `grep` to obtain patterns from an attacker-selected path instead of treating the value as a literal search term. Other supported `grep` options can alter matching, file handling, output, or resource consumption. This is argument injection rather than shell-command injection: shell operators embedded in the term are not executed, and the finding does not establish arbitrary code execution. ### Attack Path 1. An attacker or untrusted caller controls the argument to the `search` command. 2. The caller supplies a value beginning with a hyphen, for example: ```bash awesome-pentest search '--file=/dev/zero' ``` 3. The script executes the equivalent of: ```bash grep -i '--file=/dev/zero' "$f" ``` 4. `grep` parses the user-controlled value as an option rather than as the intended pattern. 5. Search behavior is modified and may consume unexpected local input or excessive resources. ### Impact Assessment The command runs with the privileges of the user invoking the skill. It does not cross a pr ...[truncated 374 chars]
Remediation: View remediation
/dev/null || true) ``` For a search function intended to match literal text rather than regular expressions, also use fixed-string matching: ```bash local m m=$(grep -iF -- "$term" "$f" 2>/dev/null || true) ``` Additionally: 1. Apply a reasonable maximum length to search terms. 2. Document whether regular expressions are supported. 3. Add tests for values beginning with `-`, including `-e`, `-f`, and long-option forms. 4. Consider invoking `grep` under resource limits if the command may process attacker-controlled regular expressions or large log files. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill metadata and documentation claim it can browse curated penetration-testing resources and exploit databases, but the file only documents a generic placeholder CLI with no evidence of retrieval, browsing, or exploit-database access. This kind of capability misrepresentation is dangerous because users or downstream agents may grant trust, invoke it in security workflows, or make decisions based on nonexistent functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill metadata and documentation claim it can browse curated penetration-testing resources and exploit databases, but the file only documents a generic placeholder CLI with no evidence of retrieval, browsing, or exploit-database access. This kind of capability misrepresentation is dangerous because users or downstream agents may grant trust, invoke it in security workflows, or make decisions based on nonexistent functionality.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The tool records all user inputs and exposes them via export, search, recent activity, status, and reporting features in plaintext. In the context of a purported pentest tool, this is especially dangerous because collected data may include secrets, vulnerability notes, internal hostnames, or exploit research that becomes easy to retrieve and exfiltrate locally.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The implementation does not match the declared purpose of browsing pentesting resources or exploit databases; instead it presents a generic local data collection and logging interface. This kind of capability mismatch is dangerous because users may grant trust based on the manifest while the script quietly captures and stores arbitrary inputs for unrelated purposes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Commands such as generate, rotate, store, retrieve, verify, revoke, and policy resemble credential or secret-management workflows that are not justified by the stated purpose of browsing curated pentest resources. In this context, the mismatch makes it more likely users will provide sensitive material that the script then stores in plaintext logs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documented commands are extremely generic (help, run, info, status) and are presented without any scope, argument validation rules, or operational constraints. In an agent setting, vague trigger surfaces can lead to unsafe invocation assumptions, unintended command forwarding, or overbroad execution paths when combined with other tooling.
Content: No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 91% confidence
Finding: The phrase 'Run any command' suggests unconstrained command execution with arbitrary arguments and no documented allowlist or sandbox. In an agent-integrated skill, this can normalize unrestricted execution and increase the risk of command abuse, privilege misuse, or chaining into harmful system actions.
Content: Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.
md
## Usage Run any command: `awesome-pentest <command> [args]` --- Powered by BytesAgain | bytesagain.com | hello@bytesagain.com

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The branding and description market the script as a pentest/security toolkit, but the code performs only local recording of arbitrary inputs. Misleading branding increases social-engineering risk by causing users to trust and use the tool in sensitive workflows where they may disclose internal targets, findings, or credentials.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script creates a persistent local data directory and writes user-provided content to it despite the skill being described as a browsing/research utility. Undisclosed persistent storage broadens the privacy and security risk because users may enter sensitive notes, credentials, targets, or assessment data assuming the tool only performs lookup functions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: At this line and throughout similar handlers, user input is appended directly to plaintext log files with no warning, masking, or protection. This is dangerous because operators of a 'security' tool may enter passwords, API keys, target details, or other sensitive assessment data that then remains readable on disk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.