pentest-r1-autonomous-penetration-testing

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.75). The set contains direct GitHub repository URLs from small/unvetted accounts (unslothai and KHenryAegis) which are common vectors for distributing unreviewed code or binaries (high-risk), while the other links are placeholders/local (http://target, http://localhost), a domain (ara.so) and an arXiv paper which are low-risk — overall the presence of untrusted GitHub sources makes this collection moderately to highly suspicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The runtime path evaluate_on_ctf_challenges() → env.start(challenge["id"]) → env.execute_command("cat /challenge/description.txt") ingests the CTF container’s /challenge/description.txt (outsider-authored challenge text) into the agent’s prompt via _build_prompt(observation) → tokenizer(prompt, ...).