ai2pentesttool-installer
Fail
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs the user to clone an external repository from a source (
https://github.com/penligent/AI2PentestTool.git) that is not categorized as a trusted organization or well-known service. - [REMOTE_CODE_EXECUTION]: The skill executes code downloaded from the remote repository via
python main.py. It also describes an 'AI-powered installation plan' feature where an AI agent generates commands that are subsequently executed on the host system, creating a significant risk of arbitrary command execution. - [COMMAND_EXECUTION]: The skill frequently invokes shell commands using
subprocess.runand other execution methods to perform tool installations, system path checks, and network connectivity tests. - [PRIVILEGE_ESCALATION]: The documentation explicitly instructs the user to run the installer with administrative privileges (
sudo python main.py install sqlmap), which would grant the externally sourced code full control over the system.
Recommendations
- AI detected serious security threats
Audit Metadata