SQLMap Database Penetration Testing
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPRIVILEGE_ESCALATION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous command-line templates for executing
sqlmap. These commands are designed to interact with remote databases and potentially the underlying operating system. - [DATA_EXFILTRATION]: Multiple sections detailed in
SKILL.md(e.g., Step 5: Extract Data) provide commands specifically for dumping database content, including usernames, password hashes, and sensitive records, via the--dumpand--dump-allflags. - [PRIVILEGE_ESCALATION]: Under the 'Advanced' section, the skill includes commands for gaining an interactive OS shell (
--os-shell), executing arbitrary OS commands (--os-cmd), and performing file-system operations (--file-read,--file-write), which can lead to full shell access and privilege escalation on a vulnerable host. - [SAFE_PRACTICE]: The skill documents 'Legal Requirements' and 'Constraints', explicitly advising the user to only test systems with written authorization and cautioning against the illegal use of Google Dorking. Unlike malicious skills, it does not attempt to hide its purpose or bypass the agent's safety guidelines.
Audit Metadata