poc-validator

67 / 100 · Review before installing

Check before installing. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By SHAdd0WTAka/Zen-Ai-Pentest (GitHub) · security · 506 stars · scanned at commit a32344d

Proof-of-Concept (PoC) Validation Skill for security exploit verification. Use when validating exploitability of vulnerabilities, generating tailored payloads, executing exploits in sandboxed environments, or verifying successful exploitation (e.g., SQL injection, CVE exploitation, command injection). Triggers on tasks involving payload generation, exploit execution verification, sandboxed testing, or confirmation of administrative access/data exfiltration after exploitation attempts.

Works with any agent that supports SKILL.md skills.

What this skill can do

Downloads and installs other software

The author does not mention this.

Found in 2 places.

.agents/skills/poc-validator/assets/Dockerfile.sandbox, line 7RUN apt-get update && apt-get install -y --no-install-recommends \
.agents/skills/poc-validator/references/docker_sandbox_setup.md, line 44RUN apt-get update && apt-get install -y \

Sends data to these websites: github.com

This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.

Found in 5 places.

.agents/skills/poc-validator/assets/Dockerfile.sandbox, line 18RUN wget -q https://github.com/projectdiscovery/nuclei/releases/download/v3.1.0/nuclei_3.1.0_linux_amd64.zip && \
.agents/skills/poc-validator/references/docker_sandbox_setup.md, line 51RUN wget -q https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei-linux-amd64.tar.gz && \
.agents/skills/poc-validator/scripts/sandbox_executor.py, line 178response = requests.get(url, headers=headers, timeout={timeout})

Show 2 more

.agents/skills/poc-validator/scripts/sandbox_executor.py, line 180response = requests.post(url, data={{"test": payload}}, headers=headers, timeout={timeout})
.agents/skills/poc-validator/scripts/sandbox_executor.py, line 182response = requests.request(method, url, headers=headers, timeout={timeout})

Changes files outside its own folder

The author does not mention this.

Found in 1 place.

.agents/skills/poc-validator/assets/Dockerfile.sandbox, line 20mv /tmp/nuclei /usr/local/bin/ && \

Runs commands on your computer

The author does not mention this. Expected for a security skill.

Found in 9 places.

.agents/skills/poc-validator/scripts/cleanup_sandbox.py, line 27"docker", "kill", container_id, stdout=asyncio.subprocess.DEVNULL, stderr=asyncio.subprocess.DEVNULL
.agents/skills/poc-validator/scripts/cleanup_sandbox.py, line 32"docker", "rm", "-f", container_id, stdout=asyncio.subprocess.DEVNULL, stderr=asyncio.subprocess.DEVNULL
.agents/skills/poc-validator/scripts/cleanup_sandbox.py, line 59"docker", "ps", "-aq", "--filter", f"name={prefix}", stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE

Show 6 more

.agents/skills/poc-validator/scripts/cleanup_sandbox.py, line 100stdout=asyncio.subprocess.PIPE,
.agents/skills/poc-validator/scripts/cleanup_sandbox.py, line 101stderr=asyncio.subprocess.PIPE,
.agents/skills/poc-validator/scripts/cleanup_sandbox.py, line 147"docker", "container", "prune", "-f", stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE
.agents/skills/poc-validator/scripts/cleanup_sandbox.py, line 154"docker", "network", "prune", "-f", stdout=asyncio.subprocess.PIPE, stderr=asyncio.subprocess.PIPE
.agents/skills/poc-validator/scripts/sandbox_executor.py, line 342"docker", "kill", container_name, stdout=asyncio.subprocess.DEVNULL, stderr=asyncio.subprocess.DEVNULL
.agents/skills/poc-validator/scripts/sandbox_executor.py, line 354"docker", "rm", "-f", container_name, stdout=asyncio.subprocess.DEVNULL, stderr=asyncio.subprocess.DEVNULL

Safer alternatives

Low-risk skills in the same category (security) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'poc-validator' ] || [ -L ~/.agents/skills/'poc-validator' ]; then echo 'A skill folder named poc-validator already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/SHAdd0WTAka/Zen-Ai-Pentest' "$d" && git -C "$d" checkout --quiet 'a32344d8e4c094113c630beeaff131fe06171e12' -- '.agents/skills/poc-validator' && mkdir -p ~/.agents/skills && cp -R "$d"/'.agents/skills/poc-validator' ~/.agents/skills/'poc-validator' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'poc-validator' ~/.claude/skills/'poc-validator' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for SHAdd0WTAka/Zen-Ai-Pentest shows the score of its lowest-scoring skill.

SkillTrust badge for SHAdd0WTAka/Zen-Ai-Pentest

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/SHAdd0WTAka/Zen-Ai-Pentest.svg)](https://zalavijaysinh.github.io/skilltrust/repos/SHAdd0WTAka/Zen-Ai-Pentest/)

Score history

Date	Version	Score
2026-11-11	`a32344d`	67