hunt-laravel
Fail
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill clones an external repository (github.com/ambionics/laravel-ignition-rce) and executes a PHP script from it to exploit CVE-2021-3129. Downloading and running code from non-whitelisted third-party sources is a high-risk activity.- [COMMAND_EXECUTION]: Extensive use of shell commands (curl, git, php, python3) to interact with targets and process data. The automated alerts for piping curl output to python3 are false positives, as the skill correctly uses the 'json.tool' module for safe formatting rather than direct code execution.- [EXTERNAL_DOWNLOADS]: Fetches exploitation tools and dependencies from GitHub during the vulnerability testing phases.- [CREDENTIALS_UNSAFE]: The skill is specifically designed to locate and expose sensitive credentials, including APP_KEY and database passwords, from the target's environment files and log outputs.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from target Laravel applications, which could contain malicious instructions designed to influence the agent.\n
- Ingestion points: curl commands targeting application endpoints, dashboards, and log files in Phase 1 through 4.\n
- Boundary markers: None present; target output is processed directly by the agent.\n
- Capability inventory: Subprocess execution (php, python3), network access (curl), and file system writes (git clone).\n
- Sanitization: Limited to basic text filtering via grep, head, and tail.
Recommendations
- HIGH: Downloads and executes remote code from: https://$TARGET/telescope/api/commands, https://$TARGET/telescope/api/redis, https://$TARGET/telescope/api/requests - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata