Skill

pentest-tools

skill:zhaoxuya520/reverse-skill#pentest-tools

主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。

skills.sh SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:48 UTC at cab634b

findings

—

highest severity

threat classes

632

files scanned

0/24,300

checks satisfied

package advisories

Why this verdict

plugin skills/pentest-tools/src-hunter Suspicious

suspicious: floor fact PY-DECODED-DIRECTIVE (DET:08e7ead89fa5cced)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:1db51ba070ae8fdf)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:23976a1d14791007)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:2a22a8de0f7275f4)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:2c113f2267a70867)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:37f63f87a63812d8)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:445751c13a899144)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:512afd519be3a5c3)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:654a0ca85a6a8076)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:69285b5dd3004f4c)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:6ad5f59dbc7d2082)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:6d20b7a52cdfd027)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:71674f9a5b35f2e1)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:78f0851c6c25b2b3)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:854a2e65d9d3c17b)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:99c00191afa001fb)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:a210e3011e109399)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:a70c246b9e241fa0)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:b170bfd31ea17eaf)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:b4d25e56a0df669b)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:b521636cdf5c0f58)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:be4036407a1364c7)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:e11390ec63b5c3da)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:e24064735db3dc45)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:e2a873d1bbe85ed1)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:e9883ac07f0f5470)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:ebd27ef18ed24d88)
suspicious: floor fact PY-DECODED-DIRECTIVE (DET:f6b9a26c16eae6e4)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:07bbe9122d1f6ca7)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:109c7dca8814101a)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:11d03ed5df0cd7d7)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:1ad2f0de1c274efb)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:298aa9a06bd71661)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:3c616a89c16c192a)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:4673a6be4d8d0abb)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:4846925366dab0dd)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:4fc491f833b59f1c)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:529030ebf22e4647)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:744658cad4329fb0)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:79e9cf14d729e4ae)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:8194eda02104d09d)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:85b590d5544dbedf)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:92ac21d06b681fe0)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:958692397bae7183)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:984a1d9b733b9282)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:9f6107657fdda565)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:a6219ae2391b77b7)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:aa8b388acae59965)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:b5ee0ce711f25b8e)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:c2b4923077656638)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:cf81987540c27406)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:f049a845ea69b19a)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:f93ce294f2ae98e0)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:fe86d1ea951460ae)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:ffcd7b114b4ce05a)

skill skills/pentest-tools Suspicious

suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:2b50857c3269117a)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:413198c9168eac16)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:583c788642dfb923)

Security findings 0

No individual findings recorded

The suspicious verdict rests on the coverage gaps below.

Coverage gaps 24742

Parts of the artifact the static analysis could not fully examine.

unanalyzable_binary binary content is only byte-scanned

skills/pentest-tools/src-hunter/references/payloader/by-category/web/文件漏洞.md

unanalyzable_binary binary content is only byte-scanned

skills/pentest-tools/src-hunter/references/payloader/by-category/web/请求走私.md

unanalyzable_binary binary content is only byte-scanned

skills/pentest-tools/src-hunter/references/payloader/waf-bypass.md

unanalyzable_binary binary content is only byte-scanned

skills/pentest-tools/src-hunter/references/playbooks/file-upload.md

unanalyzable_binary binary content is only byte-scanned

skills/pentest-tools/src-hunter/references/playbooks/http-smuggling.md

glob_budget_exceeded reference source exceeds 262144 characters

skills/pentest-tools/src-hunter/references/payloader/raw/web.json

no_dataflow_for_batch batch file: string-literal extraction only

burp-mcp-full/build.bat

no_dataflow_for_batch batch file: string-literal extraction only

burp-mcp-full/gradlew.bat

no_dataflow_for_java java file: string-literal extraction only

burp-mcp-full/src/main/java/com/burpmcp/BurpMcpExtension.java

no_dataflow_for_java java file: string-literal extraction only

burp-mcp-full/src/main/java/com/burpmcp/McpHttpServer.java