pentester-mcp-security-tools
Fail
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires cloning a repository from an untrusted third-party GitHub account (halilkirazkaya/pentester-mcp) and installing dependencies from its remote requirement files.\n- [PRIVILEGE_ESCALATION]: Documentation explicitly instructs users to run the server with root privileges (sudo) or to grant the agent passwordless sudo access for specific binaries by modifying the /etc/sudoers.d/ directory.\n- [COMMAND_EXECUTION]: The application executes various shell commands via subprocess.run. It uses a pattern of splitting user-supplied flag strings (flags.split()), which is a known vector for argument injection attacks if the input is not strictly validated.\n- [DYNAMIC_EXECUTION]: The server.py implementation utilizes dynamic module loading via importlib.import_module to register tool capabilities at runtime based on an external YAML configuration file.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes large volumes of data from external security tools. While it applies output truncation, it lacks robust sanitization to prevent malicious data from manipulating the AI agent's logic.\n
- Ingestion points: Standard output and error streams from security tool executions (SKILL.md).\n
- Boundary markers: None present beyond character truncation.\n
- Capability inventory: Extensive network and system capabilities including port scanning, credential dumping, and web fuzzing (SKILL.md).\n
- Sanitization: Lacks sanitization or escaping of tool outputs before they are returned to the agent context.
Recommendations
- AI detected serious security threats
Audit Metadata