SQLMap Database Penetration Testing
Fail
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: HIGHCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides explicit instructions for executing arbitrary operating system commands on a target server using the
--os-cmdflag. - [DATA_EXFILTRATION]: The skill details methodologies for dumping complete database contents, specific tables, and sensitive columns such as usernames and passwords using flags like
--dumpand--dump-all. It also covers the extraction of password hashes for offline cracking. - [REMOTE_CODE_EXECUTION]: The skill instructs the agent on how to obtain an interactive OS shell (via
--os-shell) and how to perform file uploads (via--file-write) to gain persistent access to a target system. - [EXTERNAL_DOWNLOADS]: The documentation references downloading tools from external sources (GitHub) to perform these operations, which can introduce unverified code into the execution environment.
- [PROMPT_INJECTION]: While the skill contains a legal disclaimer, the core content focuses on bypassing security filters (WAF/IPS) using tamper scripts and other evasion techniques, which can be misused to circumvent safety guidelines.
Recommendations
- AI detected serious security threats
Audit Metadata