performing-external-network-penetration-test
Warn
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a wide array of command-line tools for security testing, including nmap, nuclei, sqlmap, and msfconsole. This involves executing commands with significant impact on the host system and the network.
- [EXTERNAL_DOWNLOADS]: The skill refers to several external scripts and tools that are not provided within the skill package, such as proxyshell_exploit.py, linpeas.sh, and winPEAS.exe. These are executed directly, representing an unverifiable dependency risk. It also fetches data from crt.sh, which is a well-known service for Certificate Transparency logs.
- [REMOTE_CODE_EXECUTION]: The skill documents and guides the execution of remote code execution (RCE) exploits. Examples include using Metasploit for EternalBlue and exploiting Log4Shell via specifically crafted curl commands.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from external targets (e.g., website content, DNS records, tool outputs) and processes it using high-capability tools without sanitization or boundary markers.
- Ingestion points: Website responses, tool outputs from nmap, nuclei, nikto, linpeas, etc.
- Boundary markers: None identified.
- Capability inventory: Shell command execution, network requests, and file system writes.
- Sanitization: None identified.
Audit Metadata