file-path-traversal
Warn
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONOBFUSCATION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill provides instructions and payloads to access highly sensitive files that store credentials and authentication data, such as
/etc/shadow,/root/.ssh/id_rsa, and application configuration files (e.g.,wp-config.php,config.php). - [REMOTE_CODE_EXECUTION]: It details procedures for achieving remote code execution on a target system through techniques such as log poisoning (injecting PHP payloads into web server or SSH logs) and the use of PHP wrappers like
php://input,data://, andexpect://. - [DATA_EXFILTRATION]: The skill enables the unauthorized reading of arbitrary server-side files, which can lead to the exposure of source code, environment variables (
/proc/self/environ), and internal network information (/etc/hosts). - [OBFUSCATION]: It includes various encoding and bypass techniques, such as URL encoding, double encoding, and overlong UTF-8 sequences, specifically designed to evade security filters and web application firewalls.
- [COMMAND_EXECUTION]: The workflow relies on executing command-line tools such as
curl,ffuf, andwfuzzto interact with and exploit remote targets.
Audit Metadata