hexstrike-ai-pentest

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). This is a pseudonymous/unknown GitHub repository that packages and instructs you to clone, install, and run a pentesting framework which may pull/execute many third‑party tools and dependencies — making it a moderate-to-high risk source for malware or misuse if you don't fully audit the code and dependencies first.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This project is a powerful offensive-security framework (automated exploit generation, exploitation/post‑exploitation, credential/force tools, and evasion techniques) that strongly enables deliberate malicious activity and data exfiltration if misused outside authorized engagements.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs cloning and installing code from https://github.com/0x4m4/hexstrike-ai and then running its MCP server (python path/to/hexstrike/mcp_server.py), which means remotely fetched repository code would be executed and would directly control agent prompts and runtime behavior.