pentestcompanion-workspace
Warn
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download application source code and associated files from an unverified third-party GitHub repository (github.com/Poellie01/PentestCompanion.git).
- [COMMAND_EXECUTION]: Multiple shell commands are utilized to set up the environment, including
git clone,docker compose,pip install, and shell-based configuration usingsedandxargs. - [REMOTE_CODE_EXECUTION]: The application's core design involves running arbitrary command-line tools (e.g., nmap, sqlmap) using
subprocess.run, which allows for the execution of external binaries and scripts. - [DATA_EXFILTRATION]: The
pcloghelper function usescurlto transmit terminal output to a network endpoint. While intended for logging tool results, this pattern allows for the exfiltration of sensitive command-line data.
Audit Metadata