hunt-file-upload
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user or agent to install the
evilarcpackage from the Python Package Index (PyPI) usingpip3 install evilarcfor archive-based path traversal testing. - [REMOTE_CODE_EXECUTION]: The skill references an external, non-trusted GitHub repository (
https://github.com/mistymntncop/CVE-2023-4863) as a source for Proof of Concept (PoC) exploit code targeting WebP processing vulnerabilities. - [COMMAND_EXECUTION]: The skill utilizes several shell commands (
cat,curl,zip,tar,ln,python3) to construct malicious payloads locally and to interact with remote target APIs to validate vulnerabilities. - [DYNAMIC_EXECUTION]: The skill dynamically generates various payload files (including
.mvg,.svg,.m3u8, and.txtfiles) on the local filesystem (/tmp/) to be used during the security testing process.
Audit Metadata